Security

recoveryOS and diagnostics environments in Mac computers

The recoveryOS is completely separate from the main macOS, and the entire contents are stored in a disk image file named BaseSystem.dmg. There is also an associated BaseSystem.chunklist which is used to verify the integrity of the BaseSystem.dmg. The chunklist is a series of hashes for 10 MB chunks of the BaseSystem.dmg. The UEFI firmware evaluates the signature of the chunklist file, and then evaluates the hash for one chunk at a time from the BaseSystem.dmg, to ensure that it matches the signed content present in the chunklist. If any of these hashes does not match, booting from the local recovery OS is aborted, and the UEFI firmware attempts to boot from Internet Recovery instead.

If the verification completes successfully, the UEFI firmware mounts the BaseSystem.dmg as a ramdisk and launches the boot.efi contained therein. There is no need for the UEFI firmware to do a specific check of the boot.efi, nor for the boot.efi to do a check of the kernel, because the completed contents of the OS (of which these elements are only a subset) have already been integrity checked.

The procedure for booting the local diagnostic environment is mostly the same as launching the recoveryOS. Separate AppleDiagnostics.dmg and AppleDiagnostics.chunklist are used, but they are verified the same way as the BaseSystem files. Instead of launching boot.efi, the UEFI firmware launches a file inside the dmg named diags.efi, which is in turn responsible for invoking a variety of other UEFI drivers that can interface with and check for errors in the hardware.

Helpful?

Apple Platform Security

recoveryOS and diagnostics environments in Mac computers