Hacking Around in Lion's Recovery Mode

Boot holding down the R key and you are placed into Lion’s Recovery Mode. From inside Recovery Mode, you can select a number of options. Many are helpful, especially for road warriors. But in a centralized environment, not everyone should be able to perform potentially dangerous operations. One way to eliminate such an option is to just wipe the Recovery Mode, but what if you actually wanted to leave Recovery Mode…

To see the Recovery Partition, check out this article. Once you are in the Recovery Partition, there are lots of nifty little toys. For example, to see the menu of options shown in Recovery Mode, run Mac OS X Utilities in the /Volumes/Mac OS X Base System/System/Installation/CDIS directory (expand the Mac OS X Base System dmg to see it in Volumes). Or to get rid of your dock, run the Lock app in the same directory (gets rid of your dock until you click an app window at least). Or to get rid of the dock and menu, use LCA (again, reappears when you click on another window). Or more to the point of what most want to do, nested within the Contents/Resources/Utilities.plist directory of the Mac OS X Utilities you can edit the items that appear in the directory. You can also add items in, provided they have no dependencies not in the recovery build of OS X (see otool to track dependencies).

Editing the graphical interface for Recovery Mode is also done here. Each of the icons and other graphical elements are exposed, for easy replacement (menu and icons). For example, the /Volumes/Mac OS X Base System/System/Installation/CDIS/Mac OS X Utilities.app/Contents/Resources/LowBatteryImage.tiff or TimeMachineIcon.png, Utilities.icns or DFA.icns in the same directory. You can even reformat the informational screens, within each language by going into each lproj.

While there are aspects of Recovery Mode that I haven’t figured out yet, overall I think it’s pretty easy to be able to customize as needed, and look forward to seeing just how far it’s taken in the next weeks to come.


  • Jason Bush
    October 10, 2011 - 2:54 pm | Permalink

    Have you had any luck converting these into NetBoot Images?

    • June 29, 2012 - 7:49 am | Permalink

      You figure that out yet? I have a solution I can post if need be.

  • Pingback: 10 Tips on Policy Enforcement and Tracking for Mac OS X | Krypted.com

  • Katsuragi Misato
    November 5, 2012 - 2:22 am | Permalink

    I’d changed some icons in BaseSystem.dmg (converted it to r/w, than back again to UDIF).
    In that case booting with Cmd+r doesn`t work anymore, just gray screen. Booting with Alt pressed calls up boot volume selection screen, selected from there Recovery HD boots as usual. Putting back untouched BaseSystem.dmg to Recovery HD makes Cmd+r work again.

    What I’m doing wrong?

  • Comments are closed.