Dojo (HowTo)







  Easter Eggs




  Martial Arts

Apple Easter Eggs

By: David K. Every
& Daniel Fanton
(C) Copyright 1999 DKE - All Rights Reserved.

Egging is not hard. It takes a bit of time, creativity, and knowledge of your Mac, but the result is often rewarding.

Simple Egging

The easiest way to egg is to hold down the buttons Shift, Option, Command, Control, and Caps Lock all at once. Then, find an application or Control Panel made by Apple, open it, and hold these buttons down while getting info. on it. If something unusual happens, begin the process of elimination until you can figure which keys are needed for the egg to work.

Click in random places inside the about boxes and use balloon help often. Let anything like icons, pictures, or version numbers be your victim, not just in about boxes, but anywhere. After you have read a few of the eggs in this file, your job is clear.

Advanced Snooping

Programmers like to keep some of their eggs in secret from the general public's prying eyesñkind of like an "inside joke"ñwhile they leave a permanent mark at the same time. So, the programmers stuff their names into "no man's land," a place few people besides programmers and hackers are familiar with. This is also a safe place to keep the easter eggs from conflicting with another program. Remember, Apple discourages easter eggs for that very reason. In order to dig into the computer, we need a few toolsÖ

  • CanOpener - This program will take any program or file and divide it into text, sounds, icons, and pictures. The text is all code that can be found in ResEdit, mushed together in one big page. This is helpful for searching the entire resource fork. CanOpener will also extract text not in the code which is probably its best feature along with the fact that it will extract many different types of images. Besides that, it is fast and has a pleasing interface, but it doesn't do anything really important. CanOpener is commercial but fairly cheap.
  • ResEdit - ResEdit will allow you to view the guts of the victim application. Once opening anything with ResEdit you can make it visible (Get Info. in File Menu), change the resource fork, and do a great deal of things that can potentially damage the application. The best places to look are in the PICT, SND, TEXT, STR, STR#, and ic18 resources. Take a look at other easter eggs to get an idea of where to search. Be careful. This program saves as it goes. If your computer crashes while using it, everything you did is saved. ResEdit is free and available at Apple's web site.
  • Resorcerer -- is a similar program to ResEdit, but commercial. It also has a powerful find capability. The problem with egging, is that you don't usually know what you are looking for until you find it.
  • ROMmie - This program will tear apart your ROM into a broken-down text file of your ROM, a ResEdit file, and a dump (good luck getting this 3 meg file openóuse BBEdit). Version 1.0 failed on my Macintosh with System 7.5.1 but worked fine on a Performa 6115 with System 7.5 and worked in MacOS8. This program is free but hard to find. You can download it at my web site.
  • MacsBug - This program will confuse the hell out of you. This program is free and is available on Apple's ftp site.
  • Norton Disk Editor - This application comes with Norton Utilities, a commercial program. Unlike ResEdit, it allows you to edit sectors, jumbled text, and symbols. It combines all of the file's resources and more. You will never use this as a practical file, but it is great to use while just snooping through your system and Apple applications for easter eggs. Besides, Norton Utilities is a great program to own, so this is just one more reason to buy it.
  • Any universal text reader - BBEdit Lite (it's shareware!) works best. Drag any program onto BBEdit and you will be able to read the hidden text in the file. You can also search the text.

Knowing how to use the above programs is not simple. I don't know most of them. However, I do know how to use them to find easter eggs, which takes little knowledge. It would take a long time to explain how to use each of the programs for other uses, but it should be very easy to search for eggs. Take a look at some of the easter eggs that use these programs. If you have the time, explore with them. It's not that hard. Have fun!


To get into advanced egging (or looking for System Eggs), it often requires MacsBug. MacsBug allows you to snoop in the hardware componenets of your computer, primarily the ROM and RAM. You should be able to find MacsBug on Apple's site. Just place MacsBug in your System Folder (it is not an application) and to use it, simply restart your computer -- when you want to go into the debugger, just push the keys Command and the Start-up key.

Another note about MacsBug: When MacsBug is installed, if your computer bombs it will go straight to MacsBug. Pressing "G" and return key may get things to go on. If that doesn't work you can try "ES" (Exit-to-shell, which means go to the finder) and return. And if that doesn't work "RS" (Restart). Be careful (follow directions), you are romping through memory and could screw-up your system.

Using MacsBug

Once in MacsBug, simply follow the directions. If you would like to find more eggs on your own, on a non-PCI Mac type DMA 40800118 999 (display memory in ASCII from location 40800118 and on up) and keep pushing return until you see something interesting. If you reach 408A... you should stop because then it gets pretty boring and I donít think there is anything past there. Some computers will have the "What are you staring at?" message, and others will have other messages. It is possible to find things out of the range I mentioned, so feel free to look.

You can always return to the desktop by simply typing G and pushing Return.

In some earlier versions of MacsBug, DMA does not work; simply type DM instead. They both do the same thing, just the first displays it only the ASCII text.

Also, MacsBug is not case sensitive, so you don't have to use caps.


I have now found the ROM really starts at address $40800000 on any non-PCI Mac and $ffc00000 on a PCI PowerMac. Smaller numbers, like between 0 and $03000000 (that's 0 to 48 megs), are in RAM. Things that you hit above that space are hardware components, like the memory controller or sound chips, of which the ROM is one. Anything in the RAM or hardware components will shift around (ROM stays the same). The best way to find the ROM is to type dl rombase in Macsbug (that stands for display the data in the variable rombase).

Finding the ASCII Character

I have also found that there is a way to search for ASCII text; handy for locating easter eggs in the RAM. In order to find something, type F 0 FFFFFF 'allocate globals'. This instruction says "Find 'allocate globals' from hardware location 0 to FFFFFF". This will search all of your ASCII from '0' up to the point specified. Once MacsBug has found something, take the left-most number, which is the ROM location, and type DMA YourGivenNumber 999. It will go to the desired egg. Press Return if you would like to keep searching. To find anything else, just replace "allocate globals" with another search term.

Take note that the search will not go past six characters and will probably have an error before the given maximum. For this reason, you can not use it for high ROM locations. Another problem is where the name of your search repeats over and over again in a location of the ROM. Once you reach that, it is best not to go on.

Finding the Pictures in the ROM

To find pictures in the ROM, use ROMmie to create a dump file. Then, use CanOpener to read that dump file. You should find at least one picture. The pictures are compressed in JPEG and are usually marked in the ROM with "AppleMark". If you don't have CanOpener, locate "AppleMark" in MacsBug, create a log file (explained below) of the JPEG script, and try to open it with a JPEG viewer. Also, for extra fun, use BBEdit to read the dump file to see what's in there.

Creating a Log File

You can also create a log file that will save all of the text in MacsBug. This can be very useful if there is something you want to keep. Just type log "name of the file" (without quotes). The name can be anything you want. The file will be put on your desktop and can be opened with SimpleText. It will also continually update until you stop using MacsBug.


Hope this helps you get started exploring. See what you can find, and let me know if you find something interesting.

Created: 07/26/99
Updated: 11/09/02

Top of page

Top of Section