Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

If you mount the Recovery HD that enables OS X Lion File Vault 2, Safari mode, and certain recovery options, you see several .efires files. What format are those and what do they contain?

share|improve this question
up vote 3 down vote accepted

These files contain resources required for displaying the boot screen of OS X Lion before loading the actual operating system or in cases there is no system partition (or when it's broken).

They contain a flat list of files (no hierarchy), and each file has a name of up to 64 characters. The file format is as follows; all numbers are little endian, i.e. least significant byte first.

  • Two bytes 0x0200 with unknown purpose
  • Two byte short integer with the number of file entries (e.g. 0x3800 is 56 files)
  • Now there will be one record for every file entry:
    • 64 bytes ASCII file name, with NUL bytes used to fill up
    • 4 byte integer offset of the file data within the archive file
    • 4 byte integer length of the file data within the archive file
  • There is an additional unused record after the file entries consisting of 72 NUL bytes.
  • Now there is the actual file data. There are no gaps or separators, the file entries described above position the data of all files right next to each other.

The first file's data offset in e.g. an archive file with 56 entries is 0x0C10, or 4108 bytes, by default:

2 bytes unknown + 2 bytes file count + (56+1 file entries) * 72 bytes each = 4108.

The second file's data offset in the same file is 4108 plus the length of the first file's data.

These files are recreated automatically whenever you change a setting relevant for the boot login screen, e.g. whether to enable Safari mode in Security & Privacy preference pane in System Preferences). It uses default system resources to do this, so if you want to change e.g. the Apple icon, it is sufficient to edit the regular resource and have the system recreate the corresponding .efires archive file.

share|improve this answer
Very interesting; thanks for posting your research! – Gordon Davisson Dec 5 '11 at 1:29
@Gordon Thanks. Too bad it's not that important -- didn't figure out the last paragraph until I was finished writing a tool to generate these files ;) – Daniel Beck Dec 5 '11 at 6:13
@Daniel Beck you should release the source for your tool :c – MarcusJ Aug 25 '14 at 8:53

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .