Advocacy
Dojo (HowTo)
Reference
Markets
Museum
News
Other
Myths
Press
General
Hack
Hardware
Interface
Software
Standards
People
Forensics
Web
CodeNames
Easter Eggs
History
Innovation
Sightings
Opinion
Martial Arts
ITIL
Thought
|
By: David K. Every
& Daniel Fanton
(C) Copyright 1999 DKE - All Rights Reserved.
Egging is not hard. It takes a bit of time, creativity, and knowledge of your Mac, but the result is often rewarding.
Simple Egging
The easiest way to egg is to hold down the buttons Shift, Option, Command, Control, and Caps Lock all at once. Then, find an application or Control Panel made by Apple, open it, and hold these buttons down while getting info. on it. If something unusual happens, begin the process of elimination until you can figure which keys are needed for the egg to work.
Click in random places inside the about boxes and use balloon help often. Let anything like icons, pictures, or version numbers be your victim, not just in about boxes, but anywhere. After you have read a few of the eggs in this file, your job is clear.
Advanced Snooping
Programmers like to keep some of their eggs in secret
from the general public's prying eyesñkind of like an
"inside joke"ñwhile they leave a permanent mark at
the same time. So, the programmers stuff their names into
"no man's land," a place few people besides programmers and
hackers are familiar with. This is also a safe place to keep
the easter eggs from conflicting with another program.
Remember, Apple discourages easter eggs for that very
reason. In order to dig into the computer, we need a few
toolsÖ
- CanOpener
- This program will take any program or file and
divide it into text, sounds, icons, and pictures. The
text is all code that can be found in ResEdit, mushed
together in one big page. This is helpful for searching
the entire resource fork. CanOpener will also extract
text not in the code which is probably its best feature
along with the fact that it will extract many different
types of images. Besides that, it is fast and has a
pleasing interface, but it doesn't do anything really
important. CanOpener is commercial but fairly cheap.
- ResEdit
- ResEdit will allow you to view the guts of the
victim application. Once opening anything with ResEdit
you can make it visible (Get Info. in File Menu), change
the resource fork, and do a great deal of things that can
potentially damage the application. The best places to
look are in the PICT, SND, TEXT, STR, STR#, and ic18
resources. Take a look at other easter eggs to get an
idea of where to search. Be careful. This program saves
as it goes. If your computer crashes while using it,
everything you did is saved. ResEdit is free and
available at Apple's web site.
- Resorcerer
-- is a similar program to ResEdit, but commercial. It
also has a powerful find capability. The problem with
egging, is that you don't usually know what you are
looking for until you find it.
- ROMmie -
This program will tear apart your ROM into a
broken-down text file of your ROM, a ResEdit file, and a
dump (good luck getting this 3 meg file openóuse
BBEdit). Version 1.0 failed on my Macintosh with System
7.5.1 but worked fine on a Performa 6115 with System 7.5
and worked in MacOS8. This program is free but hard to
find. You can download it at my web site.
- MacsBug
- This program will confuse the hell out of you. This
program is free and is available on Apple's ftp site.
- Norton Disk
Editor - This application comes with
Norton Utilities, a commercial program. Unlike ResEdit,
it allows you to edit sectors, jumbled text, and symbols.
It combines all of the file's resources and more. You
will never use this as a practical file, but it is great
to use while just snooping through your system and Apple
applications for easter eggs. Besides, Norton Utilities
is a great program to own, so this is just one more
reason to buy it.
- Any universal text reader - BBEdit Lite (it's shareware!) works best. Drag any program onto BBEdit and you will be able to read the hidden text in the file. You can also search the text.
Knowing how to use the above programs is not simple. I don't know most of them. However, I do know how to use them to find easter eggs, which takes little knowledge. It would take a long time to explain how to use each of the programs for other uses, but it should be very easy to search for eggs. Take a look at some of the easter eggs that use these programs. If you have the time, explore with them. It's not that hard. Have fun!
MacsBug
To get into advanced egging (or looking for System Eggs), it often requires MacsBug. MacsBug allows you to snoop in the hardware componenets of your computer, primarily the ROM and RAM. You should be able to find MacsBug on Apple's site. Just place MacsBug in your System Folder (it is not an application) and to use it, simply restart your computer -- when you want to go into the debugger, just push the keys Command and the Start-up key.
Another note about MacsBug: When MacsBug is installed, if your computer bombs it will go straight to MacsBug. Pressing "G" and return key may get things to go on. If that doesn't work you can try "ES" (Exit-to-shell, which means go to the finder) and return. And if that doesn't work "RS" (Restart). Be careful (follow directions), you are romping through memory and could screw-up your system.
Using MacsBug
Once in MacsBug, simply follow the directions. If you would like to find more eggs on your own, on a non-PCI Mac type DMA 40800118 999 (display memory in ASCII from location 40800118 and on up) and keep pushing return until you see something interesting. If you reach 408A... you should stop because then it gets pretty boring and I donít think there is anything past there. Some computers will have the "What are you staring at?" message, and others will have other messages. It is possible to find things out of the range I mentioned, so feel free to look.
You can always return to the desktop by simply typing G and pushing Return.In some earlier versions of MacsBug, DMA does not work; simply type DM instead. They both do the same thing, just the first displays it only the ASCII text.
Also, MacsBug is not case sensitive, so you don't have to use caps.
ROM vs. RAM
I have now found the ROM really starts at address $40800000 on any non-PCI Mac and $ffc00000 on a PCI PowerMac. Smaller numbers, like between 0 and $03000000 (that's 0 to 48 megs), are in RAM. Things that you hit above that space are hardware components, like the memory controller or sound chips, of which the ROM is one. Anything in the RAM or hardware components will shift around (ROM stays the same). The best way to find the ROM is to type dl rombase in Macsbug (that stands for display the data in the variable rombase).
Finding the ASCII Character
I have also found that there is a way to search for ASCII text; handy for locating easter eggs in the RAM. In order to find something, type F 0 FFFFFF 'allocate globals'. This instruction says "Find 'allocate globals' from hardware location 0 to FFFFFF". This will search all of your ASCII from '0' up to the point specified. Once MacsBug has found something, take the left-most number, which is the ROM location, and type DMA YourGivenNumber 999. It will go to the desired egg. Press Return if you would like to keep searching. To find anything else, just replace "allocate globals" with another search term.
Take note that the search will not go past six characters and will probably have an error before the given maximum. For this reason, you can not use it for high ROM locations. Another problem is where the name of your search repeats over and over again in a location of the ROM. Once you reach that, it is best not to go on.
Finding the Pictures in the ROM
To find pictures in the ROM, use ROMmie to create a dump file. Then, use CanOpener to read that dump file. You should find at least one picture. The pictures are compressed in JPEG and are usually marked in the ROM with "AppleMark". If you don't have CanOpener, locate "AppleMark" in MacsBug, create a log file (explained below) of the JPEG script, and try to open it with a JPEG viewer. Also, for extra fun, use BBEdit to read the dump file to see what's in there.
Creating a Log File
You can also create a log file that will save all of the text in MacsBug. This can be very useful if there is something you want to keep. Just type log "name of the file" (without quotes). The name can be anything you want. The file will be put on your desktop and can be opened with SimpleText. It will also continually update until you stop using MacsBug.
Conclusion
Hope this helps you get started exploring. See what you can find, and let me know if you find something interesting.
|
