34 lines
1.3 KiB
Markdown
34 lines
1.3 KiB
Markdown
The "Linked Patches" are an unusual 68k code format in the System
|
|
resource fork of Mac OS 7-9. They contain initialization code to run at
|
|
boot and runtime code for installation in RAM-based vector tables.
|
|
|
|
The first Linked Patches shipped in the interdependent 'lpch' resources
|
|
of System 7.0.
|
|
|
|
From System 7.5, 'gpch' resources contained groups of functionally
|
|
related 'lpch' resources. A group could be loaded or not according to
|
|
the host machine. This was controlled by one 'gusd' and multiple 'gtbl'
|
|
resource.
|
|
|
|
`patch_rip.py` is a Python 3 script to dump a group of 'lpch' resources
|
|
(or a single 'gpch' resource) to text.
|
|
|
|
|
|
## Usage
|
|
|
|
First, `pip3 install macresources` to get the `rfx` command-line tool,
|
|
which exposes the resources inside a resource fork like regular files.
|
|
|
|
Then point `patch_rip.py` at the System file of interest:
|
|
|
|
rfx ./patch_rip.py System/..namedfork/rsrc//lpch/ # macOS 10's kernel resource fork support
|
|
rfx ./patch_rip.py System.hqx//lpch/ # BinHex file
|
|
rfx ./patch_rip.py System//lpch/ # Rez file named "System.rdump"
|
|
|
|
To dump a numbered 'gpch' file instead, replace `//lpch/`, which expands
|
|
to a path for each lpch resource, with `//gpch/NNN`, which expands to a
|
|
single path.
|
|
|
|
The output is not disassembled, but it is annotated with the known
|
|
locations of specialised "jsr" instructions, etc.
|