March 16, 2007
Shock and Awe: How Installing Apple's Updates can Render Your Mac Unbootable and How You Can Prevent it

Yes, I am fully aware that I just told every one to update to Mac OS X 10.4.9 and I know this may be construed as me telling people not to.

When you see the "Optimizing System Performance" phase of a software update, Mac OS X is really updating prebinding. Updating prebinding has a very, very nasty bug in it (look at _dyld_update_prebinding). If multiple processes are updating prebinding at the same time, then it is possible for a system file to be completely zero'd out. Basically, all data in the file is deleted and it is replaced with nothing. This bug is usually triggered when updating Mac OS X and every update to Mac OS X has the potential to render your system unbootable depending on if the "right" file is deleted or not. It's triggered during the "Optimizing System Performance" phase of installing an update. This phase is actually just running update_prebinding. If you launch an application that links to libraries that are not yet prebound, there is a chance one of those files will be zero'd out as dyld automatically redoes the prebinding on that file.

I've been tracking this particular bug for about 18 months now. Most of the real "random" failures reported on various Mac OS X "troubleshooting" sites after a user has installed an Apple software update are actually manifestations of this bug. By real I mean not imagined problems or ones that have been there for a very long time but the user is just now noticing it and artificially connecting the cause to the recent update (it's called Pareidolia). Yes, this nasty prebinding bug has been reported to Apple and yes, it is 100% reproducible if you want to reproduce it.

Every single time you install an update to Mac OS X whether it be an iTunes update, a QuickTime update, an update for daylight saving time, a security update, an Airport update, or an actual Mac OS X update, you can be hit by this bug. In order to prevent yourself from being smacked in the face by this bug, follow this simple rule: When "Optimize System Performance" appears during the update process do not touch your computer and definitely do not launch any applications. Just back away from your computer box as if it were a swarm of bees. Yes, it does mean that if you install the Mac OS X 10.4.9 update, you may get hit by the bug.

I think it's important to note that APE's use of update_prebinding at login is not affected due to the time at which APE runs it on the ICBMs. In order for the nasty prebinding bug to manifest, multiple prebinding operations must be going on (either explicit or implicit). Assuming some implicit action needed to be done, it's already been done by the login window application (the one that shows that bar graph when you boot) on any shared libraries it links to. And once you log in, even forcing a prebinding operation won't actually cause any files to be reprebound since that action was just done.

Symptoms and Signs

The worst sign you've been hit by this bug is an inability to boot after installing a Mac OS X update. Sometimes the little wheel will just keep on spinning. Other times you'll get to the point where you should see your desktop but all you see is a blue screen (because [the] loginwindow is repeatedly crashing due to a missing library). The "easiest" sign is an application will crash either at launch or when you do a specific action and the console.log /Applications/Utilities/Console (or a crash log) will spew out a message about dyld that says: "Reason: no suitable image found." and then sometimes "file to short" [sic]. The file is too short because it is zero-length. There is an example of someone being hit by this on the internets.

Sadly, most people suffering from this bug never have a chance to see an error message to find out what file was zero'd out, especially when it prevents boot. One of the things that can help a lot in troubleshooting the problem is booting in verbose mode. Setting this option is really quite easy. Open the terminal (/Applications/Utilties/Terminal) and type:

sudo nvram boot-args="-v"

Then just enter your password. From then on, every time you reboot, you'll be in verbose mode. You can also hold Command-V at boot time to boot into verbose mode for that boot only.

Verbose mode basically just doesn't show the Apple logo (OEM logo on the ICBMs) at boot time. You get to see all the gritty ugly details in booting Mac OS X. Note: You will not understand everything that's going on during booting in verbose mode. You don't need to. All you need to do is recognize what is normal and what isn't. Also, it really helps to boot into verbose mode after an upgrade as the first reboot can take an exceedingly long time (up to 10 minutes) and booting into verbose mode will help you know your Mac hasn't frozen. (Seeing "diskarb not ready" is normal, especially after a system update).

Preventative Measures

Well, I already listed it: When "Optimize System Performance" appears during the update process do not touch your computer and definitely do not launch any applications. Just back away from your computer box as if it were a swarm of bees.

I should note that this bug seems a lot more likely to happen on an ICBM as the prebinding operation has to work on two sides of a fat file (the x86 side and the PowerPC side) so it takes longer, which means there is more time for you to trigger the bug.

Solving the Problem if You're Hit

Recovering from this bug is not the easiest thing in the world. If it's a simple crash, you can just copy a "good" version of the file off a Mac running the exact same build as the busted one or you can just run the most recent combo updater (assuming the zero'd out file is in the combo updater). If it is really bad, you'll have to boot the busted Mac into FireWire target disk mode and try to run the combo updater off a working machine. TDM is not an option if the other Mac has a different processor architecture of it is is running a newer version of Mac OS X.

What Will Apple Do?

Who knows. This bug has been filed with Apple, along with steps to reproduce it 100% of the time (at least in my testing). It was marked as a duplicate, which means the bug was already in Apple's system before I filed it. And since it is duplicate, I don't know what is going on with it. Yes, before anyone mentions it, I know prebinding is deprecated. However, Mac OS X still does it when installing Apple updates. It doesn't matter that it is deprecated if it still happens, after all.

Even if prebinding goes completely away in Mac OS X 10.5 that doesn't solve the problem for Mac OS X 10.4.x users. Security updates will continue to be released for Mac OS X 10.4.x until Mac OS X 10.6 is released (which could be many, many years from now) and every one of those updates carries the risk of "destroying" the Mac of the person that installs it until this bug is fixed.

Digg This!

 Posted by rosyna at March 16, 2007 07:43 AM

Trackback Pings:

TrackBack URL for this entry:
http://www.unsanity.org/mt-tb.cgi/415.

Listed below are links to weblogs that reference Shock and Awe: How Installing Apple's Updates can Render Your Mac Unbootable and How You Can Prevent it:

Prebinding-Fehler verhindert Hochfahren des Rechners from MacOS X FAQ
Die Firma Unsanity (bekannt für ihre "Haxies") hat einen Fehler im so genannten Prebinding von MacOS X gefunden, der wahrscheinlich die Ursache für viele Fälle ist, in denen der Rechner nach der Installation eines Systemupdates nicht mehr hochfahren will.[Read More]

Tracked on March 18, 2007 2:14 AM

Unsanity claims to have discovered serious Mac OS X installer bug from Geeks R Us
Unsanity, whose products I stay away from, seem to have come across some very useful information regarding Apple’s Installer process and a major flaw in it. You can read about the flaw and check out their software, but personally I’d stay a...[Read More]

Tracked on March 18, 2007 8:53 PM

Rosyna Discusses Prebinding Bug in OS X Updates from O'Grady's PowerPage
A post over on Unsanity wherein the author (identified as "Rosyna") describes the prebinding bug in Mac OS X 10.4. Simply put, this is where Mac OS X finishes installing an update and enters its "Optimizing System Performance" stage....[Read More]

Tracked on March 19, 2007 11:44 AM

When updating your Mac, don't touch nothing from CLICK
I just did some updates on Macs running OS X 10.4 and 10.3, and while I'm too cautious to do anything that would possibly interfere with an update while it's downloading and installing, others aren't so cautions, according to unsanity.org,...[Read More]

Tracked on March 19, 2007 2:16 PM

links for 2007-03-20 from B12 Solipsism
Having problems with Flash? - MozillaZine Forums AdBlock disables YouTube/flash files. Here's how to get around it. (tags: firefox flash) Celebrities if they were bald, via Photoshop surprisingly, I'm not on this list. Don't they know who I...[Read More]

Tracked on March 20, 2007 12:18 AM

Vista disappointment, overnights and a brief worrying moment from ic:blog
I can see this entry becoming a bit of a dull techie one, I'm afraid. For now, though, the other bits! I had a strange Sunday - the three colleagues and I, who made up the duty weekend shift, realised...[Read More]

Tracked on April 24, 2007 9:45 AM

The falling myth of Apple reliability from Fabrizio Giudici's Blog
Some latest Apple's Mac OS X updates have caused severe troubles to users because of introduced instability. One of them is related to the capability of running some Java applications.Let me just sum up what happened to me in the...[Read More]

Tracked on July 16, 2007 2:30 PM




Related:
Comments

Bottom line is that software updates should be undoable without needing access to the OS on the machine you're trying to recover.

With timemachine etc is it possible to undo an update? ie. can timemachine restore from a different computer?

Posted by: Robert Nicholson on March 16, 2007 9:28 AM

What? No.

This has nothing to do with undoing updates at all. And this bug isn't limited to affecting only shared libraries installed with an update. It can "Trash" a random file that's not associated with the update at all making undoing an update not possible.

Posted by: Rosyna on March 16, 2007 9:35 AM

I'm saying this...

If you can create the problem thru an update then it should be possible to undo the update. If you're saying that files unrelated to the update can be crashed then you're right in saying that undoing an update won't solve the problem. But how many people have been stung by an update that effected files related to the update?

My question is when this problem happens is it possible to know the full dependency graph to 100% accurately say which files can be affected by the problem.

Can you start with the complete list of dependencies?

I would still feel better if I could undo an update even if I wasn't touching the computer from start to finish.

Posted by: Robert Nicholson on March 16, 2007 10:14 AM

Great photo of the girls in Harajuku taken with your Canon Rebel camera in October 2006. Unusual to have the entire photo in full quality downloadable by clicking it on the site.

Cheers! (Living near Harajuku for 26 years)

Posted by: Tokion on March 16, 2007 10:24 AM

I keep repeating it like a parrot on various sites especially newbie/non techie (not this one) sites.

Please keep updating your Mac. Of course, do a backup of your home directory but don't "pass" the updates.

I got a second hand PPC mac mini just 2 days ago. We booted it to test, it is stuck on 10.4.3 (yes) with a very fast DSL line where it was used. It turns out some pseudo techie user made guy afraid about updates and added "It doesn't have virus ,why need update?". Guy have never applied a SINGLE update to his machine, zero entries at software update log.

Perhaps that is why we got the machine relatively cheap anyway :)

There is no point staying with an insecure (yes) or outdated OS. It doesn't have to be 10.4.9 , there are people still staying with 10.3.0 out there because of "Updates are not needed for Mac" attitude.

ps: Of course some mission critical macs are in use 24/7 without internet connection, it is up to AVID etc. to tell they should update or not.

Posted by: Ilgaz on March 16, 2007 10:30 AM

Sorry for double comment (made a habit) but lets say, you can't provide a patch to Apple for that opensource (?) component explaining why it should be that way and they wouldn't accept it?

Isn't that the purpose of opensource OS X anyway?

Posted by: Ilgaz on March 16, 2007 10:35 AM

The best and simplest way to protect yourself against bad updates is to *back up your machine to a FireWire drive* before you install the backup; that way, if your machine is FUBARed, you can simply hold down the Option key during reboot and boot off the FireWire drive and restore your system to its working, pre-update condition.

If you have two FireWire drives and are making daily backups (as every use should be doing), do the pre-update backup on one drive and then set it aside for a week or so after doing the backup, in case the update causes a problem which isn't immediately apparent upon reboot. If it turns out you get bitten a bit later after the update, you can then a) restore the OS and apps from the pre-update backup and then b) restore your data and documents from the most current post-update backup, thereby minimizing your chances of losing important work.

It's also a good idea to quit all applications before performing an update, so that (hopefully) the updater is the only thing actively tinkering with the filesystem while it's doing all the prebinding and so forth.

But doing a backup pre-update is the absolute must, and it puzzles me that nobody seems to ever mention this when giving advice about how to minimize the risk of update failures.

Posted by: Roland Dobbins on March 16, 2007 10:42 AM

Robert, for any other update related bug, yes, it is possible to have a dependency graph. For this one, no. This bug is not limited to the files in the update or any files that directly depend on it.

Prebinding is like [poetic image #54 not found]. When you update one shared library, you have to update the others that touch it, then update the ones that touch that until you have no more touching. And the amount of files changed differ greatly between computers as it depends on what is installed.

So no, there's really no way an undo mechanism could be made for this bug.

Ilgaz, the experiences of others say that Apple doesn't readily accept opensource patches to their stuff (if they accept them at all). Also, I'm not really sure how to fix it other than some locking mechanism.

Roland, no need to go crazy with paranoia before every update. Then it becomes some ritual every time you update the OS.

And you should always make backups, not just only when you are going to update something, but always. And good backups are offsite backups (in case of fire or theft).

Posted by: Rosyna on March 16, 2007 10:50 AM

You can use the installer command line tool to install any update on an external disk, regardless of the architectures and the OS versions of the two computer. Switch broken computer to target disk mode, connect to a working computer, download the combo SU on the working computer, and run "install -pkg /Path/To/SU.pkg -target /Volumes/BrokenComputer".

Posted by: Ben Artin on March 16, 2007 10:54 AM

Er, I meant "installer -pkg /Path/To/SU.pkg -target /Volumes/BrokenComputer". I always make that typo :-/

Posted by: Ben Artin on March 16, 2007 10:55 AM

Ben, if that's the same preflight logic installer.app does, it may not work. The last time I had this problem happen to me, I tried using installer.app to install the update on the broken machine. Installer.app threw an error about the OS I was trying to install being older than the currently installed one. I think it uses the current environment to determine some key preflight options.

Which is lame.

But if the installer tool doesn't do that checking, then yes, it should work.

Posted by: Rosyna on March 16, 2007 10:58 AM

I find it a good practices to divide system and applications from data through partitioning, secondary drives and/or servers. Data has a value, system and applications do not.

Yes your system may become dead but if you can boot from some other media or partition you can access your data.

I have never had this problem and usually I continue to work during updates (at home, not when I service customers).

Posted by: Christoffer Araskog on March 16, 2007 12:27 PM

I guess this explains the suggestion of applying the combo updater if something odd happens after point update. I've seen that suggestion help way too many times; probably a manifestation of this particular issue.

Knowing how a lot of QA is done, it's not something readily apparent, though should be easy enough to test for, once they know about it (which it would appear they do). Now...I hope they fix it soon.

Posted by: Tenton on March 16, 2007 4:09 PM

Does this all mean that my Apple OS is now out of warranty? ;)

Posted by: F451 on March 16, 2007 8:50 PM

Excuse me for asking what a programmer will probably consider a very dumb question indeed, but I'm not a programmer. There are a number of system maintenance programs available of the Cocktail type that allow a user to update prebindings. Does running one of these routines create the type of risk rosyna is talking about in his posting, or are these safe?

Posted by: Dana Sutton on March 17, 2007 1:12 AM

You keep repeating the word "bug" (17 times). Is it just me or are you enjoying rubbing salt into some kind of Apple wound ? That's the impression I got reading your post.

Posted by: Autocat on March 17, 2007 1:21 AM

Sometimes you just have to call a bug a bug. Is it just me or is someone attempting to troll?

Posted by: dzd on March 17, 2007 4:21 AM

People aren't used to independent software houses who dares to critise Apple in their unofficial blogs.

Especially Mac scene.

Posted by: Ilgaz on March 17, 2007 6:42 AM

Mystery solved!

Thanks for posting this. It's likely the culprit for a friend's machine that I had to fix after Help.app stopped launching for them.

I feel better knowing what probably caused the 0 byte files.

Posted by: Daniel J. Luke on March 17, 2007 7:08 AM

Dana Sutton, if there is any potential that libraries will have to be reprebound implicitly (due to a modification), then yes, running those utilities have the risk and the same amount of care should be taken. However, the risk is much, much, much lower in these cases. Then again, running prebinding won't exactly benefit you in any way (see my previous blog post for reasons on why).

F451, yes.

Christoffer Araskog, I couldn't agree more. Having been hit by this bug multiple times over the years (which is why I looked into the cause), having the user data on the separate partition has saved me many times. Also, if you have it on a separate physical disk, the risk of data loss is smaller in case of a catastrophic physical disk failure. It also makes it easier to back up just your user data.

Also, I am not sure I want to know about you "servicing customers"....

Autocat, what else should I call it? "Unrequested feature"?

Posted by: Rosyna on March 17, 2007 10:04 AM

Can I quote your conclusion for a user group news letter?


tom@macintoshsolutions.biz

Posted by: Tom on March 17, 2007 2:11 PM

Tom, sure, as long as you attribute it and mention "swarm of bees".

Posted by: Rosyna on March 17, 2007 2:34 PM

As others say, this is an important reason to backup your data as my FAQ says:

http://www.macmaps.com/backup.html

If you don't, you might as well kiss your data good bye. It is not a question of if, but when you'll lose data. And if system updates and security updates pose a thread, so do many other things as well. It goes without saying, but backing up your data is NOT an option. Knowing how to backup your data should be in every computer literacy course, and taught by every computer technician until everyone does it.

Posted by: gopher on March 17, 2007 5:40 PM

Oops, typo. That should be pose a "threat!"

Posted by: gopher on March 17, 2007 5:41 PM

Ok it's a bug that can be repeated 100% of the time.

It should be in Apple's interest to correct this. Most users aren't savvy enough to know how to fix this and I see a host of people going with their macs to Apple for a fix and/or people a notch up reinstalling the OS, still others will be doing downloads off the Apple site. This would bring the cost of their operations up a bit due to bandwidth.

Moral of the story? Apple should fix this and avoid issues with customers, it may hurt the perception people have of macs. They don't crash let alone not startup.

Posted by: alex santos on March 17, 2007 7:31 PM

I updated Quicktime and itunes and I did not find any problem. Although I am tempted to upgrade to 10.4.9 I am worried I might suffer the fate as described from above. Maybe I will do it when it is really nescessary in the future.

Posted by: casper on March 17, 2007 10:19 PM

Is this going to show up in the RSS feed every time a comment is posted? Not a single other blog does this. Some blogs actually have dedicated comment RSS feeds, but if I'm subscribed to the "main" feed, I should definitely not be getting updates every few hours when a comment is posted.

Of course, this will cause it to show up again, won't it. *sigh*

I'm just going to remove thise feed for a couple weeks and hope you fix it. Its a shame, as this is really a critical issue; it's just not one I need to see several times a day.

Posted by: Joshua Ochs on March 17, 2007 10:46 PM

Joshua Ochs, then don't subscribe to the full feed. Subscribe to the summaries feed. Look on the main .org page, lower right.

Posted by: Rosyna on March 17, 2007 11:20 PM

Wouldn't this patch to update_prebinding fix it?

mv /usr/bin/update_prebinding /usr/bin/update_prebinding_backup
cat > /usr/bin/update_prebinding << \!
#!/bin/sh
exit 0
!
chmod +x /usr/bin/update_prebinding

Yes, that's half in jest. But only half. I've fixed broken programs that easily before.

If that doesn't do it, this version should:

#!/bin/sh
if [ -f /tmp/updating_prebindings ]
then exit 0
fi
touch /tmp/updating_prebindings ${1+"$@"}
/usr/bin/update_prebindings_backup
rm /tmp/updating_prebindings

Yes, I know there's still a tiny race condition there. You get the idea. Besides, you're unsanity, you can probably do a totally cool and secure haxie that will solve the problem even if update_prebinding gets replaced by the update. :)

Posted by: Peter da Silva on March 18, 2007 4:55 AM

Peter, no. For one, the process actually run is called update_prebinding_core (the non-core spawns two cores on the ICBM, one for PPC, one for x86), And this of course doesn't take care of the implicit runs (dyld doing it directly) and if you don't have the update_prebinding process running, there will be a lot more implicit runs.

Posted by: Rosyna on March 18, 2007 5:05 AM

* Updated from 10.4.8 -> 10.4.9 on a PowerBook 12" 867 today March 18 (Tokyo time ;-))
* First I repaired permissions with Disk Utility, then did the update via System Preferences "Software Update". Did not touch the damn machine until everything was over, and only then I restarted the machine.....
* OS X hung on start up. 5 minutes, 10 minutes, 15 minutes etc. no change.
* Forced quit and grabbed my DiskWarrior 4.0 disk.
* Held down C-key while starting from DW 4.0 and after the lengthy start-up from this disk, I first repaired permissions again from the availlable application on this disk.
* Surprisingly mmany permissions was reset again, despite that I had just done this via Disk Utility.
* Next I ran the rebuild directory application and replaced the old directory with the new one made by DW 4.0.
* Another machine reboot, and finally flawless start.

I wonder what options I would have had on this out-of-warranty machine if I did not possess DiskWarrior?

It recently also saved a friend's machine that had a rather serious hard disk crash. It scavenged all directories and data (despite that the entire machine had gone lame) and allowed the data to be moved to another MAC set to Target FireWire mode.

After the broken machine came back from Apple after a hard disk swap, all data was moved back and nothing was lost (despite that my friend had never backed up). ;-)

Posted by: tokion on March 18, 2007 7:54 AM

This is referred to in relation to the 10,4.9 update, but how long has it been a problem? Is it only in 10.4, or does it go all the way back to BSD?

There will always be some risk with system updates, if errors occur as links and references are updated for the new files. Allowing arbitrary programs to be running at the time certainly increases that risk. However, OS 9 was sometimes annoyingly cautious, requiring all programs to quit for installers that never touched the System Folder. An improvement would be to move the prebinding updating into the shutdown procedure, after all user processes have terminated. Also make the installer more insistent upon rebooting, perhaps preventing any further programs from launching. More than once I've force-quit'ed an installer because I didn't think it warranted restarting (horrifying as that may sound), which really shouldn't be allowed. [Perhaps a self-resurrecting process, for immunity to even 'kill -9']

Posted by: A.Williams on March 18, 2007 10:06 AM

Except the obvious horrible corrupted System files because of disk problems and usual "bad/no name" RAM issues...

People, perhaps this is what we hear when non techie people claims OS X/software update made their macs unbootable.

To this day, I ignored those reports thinking they are a machine (RAM,disk) problem. Lets say, if 1 in 10.000 is unlucky enough to have this issue, the mysterious "DON'T INSTALL IT BROKE MY COMPUTER" versiontracker comments are solved...

Posted by: Ilgaz on March 18, 2007 10:07 AM

You talked about how the dangers of an a non-prebound application loading while an updater is explicitly running update_prebinding.

Can this bug also be triggered if a user launches two non-prebound applications at the same time?

If so, that would be a rate incidence of the problem, but how would the user keep avoid it?

Posted by: Michael Schmitt on March 18, 2007 10:29 AM

While this bug certainly needs to be fixed, for safety's sake SU should do as many standalone installers do and warn you to shutdown any other apps when it launches (it should actually do it for you automatically) and it should also set a flag that prevents any new apps launching while it's running.


Amazing, it would never occur to me to launch something while SU was running, 25 years in computers says that would be a dumb idea. Yet just the other day I had to warn someone not to do that very thing. Engineers always forget how little end users understand about how it all works.

Posted by: David S. on March 18, 2007 2:56 PM

i just would like to insisty that my old G3 iBook running 10.3.9 recently had a security update, while I tried to run an App. during the update.
This was refused by the system - i.e. the dock icon bounced a few times and then stopped. No app was launched.
This seems to be a solution to the bug that WAS implemented in 10.3 ?
Where has it disappeared to ?

Just my 2 cents...


Rip

Posted by: Rip on March 18, 2007 4:08 PM

I'm not someone that thinks Apple can do no wrong, but is this really a bug? How can they fix it? I have always considered quitting all apps prior to and not launching apps during an update as basic as doing backups. Same goes for running apps like Cocktail. It is good to know what the cause is & what to look for when you see odd things on a client's machine and the tips on repair are great too.

Posted by: danceswithsheep on March 18, 2007 10:39 PM

Prebinding is only an optimization, right? It doesn't _have to_ happen _right now_ at the end of an install.

So why must we sit there and watch it and wait for it to finish before the installer can quit?

It seems to me that the installer should simply set a flag in a file that says it's time to do prebinding again. Then the system should do the prebinding in the background at an appropriate time and in an appropriately bullet-proof way.

Posted by: Dave Yost on March 19, 2007 1:07 AM

update_prebinding is ONLY depreciated for applications in 10.4. It is still needed for frameworks and that's what the important part of Optimizing... does, although it does everything anyway.

Posted by: Tom on March 19, 2007 3:39 AM

tokion, re-read part of the original post. It talks about excessively long reboots being normal and how you can determine if you hung or not.

A.Williams, the first time I experienced the bug was in 10.2.2. It doesn't go back to BSD since this instance of prebinding is a Mac OS X problem.

Also, there's no reason a properly designed system should require you quit all apps. Furthermore, if it was easier to tell the user to log out and back in, there'd be no reason to reboot after an update.

If you do things right, people won't be sure you've done anything at all.

Michael Schmitt, yes, technically launching two apps that link to unprebound libraries would amount to two implicit instances of updating prebinding and would trigger the bug. If you allow the OS X update update_prebinding to run its course, then prebinding on app launch won't be necessary.

Rip, it wasn't fixed in 10.3.x. What you *may* be seeing there is a "feature" of Mac OS X. If an application is going to be launching with a newer version of the CoreGraphics framework than the one you logged in with, the windowserver won't allow the application to launch (and actually says so in the console, it tells you to restart).

danceswithsheep. Running Cocktail is pretty much the same as a voodoo ritual. It's best not to do something like that unless you know the technical reasons why you have it. Otherwise it's just a rock that keeps tigers away in a land devoid of tigers in the first place.

Dave Yost, see my answer to Michael Schmitt.

Tom, it's "deprecated", not "depreciated", This is a common mistake to make if you're not familiar with the word "deprecated" (I wasn't until someone from Apple told me it was different about 5 years ago).

And no, Tom, prebinding doesn't work on applications. Applications are always prebound to the first address (0x1000) past page zero. Prebinding is only a shared library thing and if you try to prebind a framework/shared library you're building using the 10.4 SDK, you'll get a deprecation warning.

Posted by: Rosyna on March 19, 2007 4:19 AM

I'm a recent victim of this bug. Maybe this is over my head but, I didn't really read a solution to this problem. I know how to avoid it, but damage is done and I'm still dealing with problem. I don't have another Mac to target-boot from so ....

I had to install a new OS on a second internal HD, move ALL my data, accts. and applications over ... then erase the original HD, reinstall OSX and move everything back ... and now I'm crashing applications constantly. No data lost, but the crashing is endless.

Posted by: matt on March 19, 2007 6:36 AM

Just wondering if this is still an issue if one boots up under "Safe Boot" and runs the OS Update or other updaters under this specific condition.

Posted by: Prairie Cossack on March 19, 2007 10:59 AM

Rosyna: "And this of course doesn't take care of the implicit runs (dyld doing it directly) and if you don't have the update_prebinding process running, there will be a lot more implicit runs."

I figured it was more complex than that. The point is that OS X is designed to make it almost always allow you to patch this kind of thing without waiting for Apple, and you guys are masters at that kind of patching... hell, it's your core business.

Posted by: Peter da Silva on March 19, 2007 11:47 AM

I assume that this could manifest itself on any system post 10.2, where the mechanism for automagically updating prebinding if necessary upon application launch was introduced?

Posted by: Ben on March 19, 2007 8:34 PM

Rosyna: I'm not doubting you, but this is pretty difficult to believe, considering the amount of bogus folklore that's out there (like the superstitious use of Repair Permissions.) What's the Radar number? So those of us inside the firewall can follow along.

David S: "Amazing, it would never occur to me to launch something while SU was running, 25 years in computers says that would be a dumb idea. [...] Engineers always forget how little end users understand about how it all works."
That's funny — I've had no compunctions about working along while an update is in progress, and I've got 30 years in computers, 15 of which at Apple. I guess different engineers just have different ideas about risk :)

Posted by: Jens Alfke on March 19, 2007 11:38 PM

Rosyna: it's "deprecated", not "depreciated"... the words are virtually synonyms, but Apple does use deprecated. Sorry the same level of English is missing in "file to short" written to the log.

Regarding prebinding, it is about updating references to global symbols found in libraries, not the fairly trivial task of making the library's code not sit on top on on others.

Posted by: Tom on March 19, 2007 11:44 PM

Jens Alfke: continuing to work in things already open isn't the issue, it's launching new apps, or a 2nd update at the same time that appears to be the issue.

"When "Optimize System Performance" appears during the update process do not touch your computer and definitely do not launch any applications."

that sentence should be emphasized in the article, would make it clear on how to avoid the "bug"

And for apple the possible solution would have a prebinding thread look for any other prebinding threads, if found, wait.

Posted by: Brian on March 20, 2007 12:29 AM

I'm running 10.4.9. After an account is created by any "Admin" through Account Preferences ..., the new user is unable to login. When I change the new account's password as root through a terminal session, then the account is accessible. I do not see the same problem, if the new account is created by root.
What underlying file(s) do I need to remove/replace to correct this problem? Thanks.
Back to top
View user's profile Send private message

Posted by: Gary Roger on March 20, 2007 8:16 AM

Will this problem be triggered if the Mac goes to sleep during an update?

Posted by: Charles on March 20, 2007 11:05 AM

I can't think why the machine going to sleep would cause this as that wouldn't from what I know trigger a call to update_prebinding. that said a machine shouldn't automatically go to sleep when an update is in progress.

Posted by: Ben on March 20, 2007 7:59 PM

I totally forgot to mention, if your machine has the screen saver enabled and it turns on, that counts as launching an application since it launches ScreenSaverEngine.

But yeah, Ben is correct. The update won't allow the machine to go to sleep while it is running.

Posted by: Rosyna on March 20, 2007 8:10 PM

I'd never thought of the possibility of the screensaver kicking in, this is probably a pretty common way that the issue could manifest itself. After all, plenty of people are in the habit of leaving computers to install/update/etc.

I take Jens's approach and tend to carry on with things during an update, actually leaving it 'complete' in the background until I've finished whatever it is I'm doing and not rebooting until a convenient moment.

Posted by: Ben on March 21, 2007 7:18 AM

Hello:

I work with the MacEnterprise Project and for many of us this is the first time we have heard about this bug. Many of our member are a little skeptical about this bug and wanted more details. Would you be will to share more technical details about this bug and your BugReporter number/description directly to me. We will be meeting with Apple and would like to discuss it with them if we feel this is truely a bug.

If you want to discuss it further, feel free to email me.

Posted by: Richard Glaser on March 21, 2007 9:32 AM

Yesterday I safe-booted a mac I have with 10.4.8, turned off any extraneous applications, set screen-saver to never go on and ran the combo 10.4.9 updater. Very smooth update and checked out various applications/utilities for issues related to the update. No problems so far. Everything is running well.

I'm thinking while I minimized any possible interruptions to the updater process, there would still be a small possibility of the updater bug happening.

Apple should have ample data on reproducing the bug and some ideas on how to fix it permanently. Mac users shouldn't have to put up with this insideous flaw.

Posted by: Prairie Cossack on March 21, 2007 9:35 AM

I would never assume Apple has ample data on reproducing the bug. I strongly recommend that if you have been hit by this supposed bug or it is critical to you or your organization, enter a bug report in Apple's BugReporter, http://developer.apple.com/bugreporter/. You can get a FREE online ADC account to report this supposed bug. The more reports Apple gets, they higher priority and more resources they will dedicate to this issue.

I would recommend, that if you have been impacted by this bug, enter a bug report. Don't assume that Apple knows or that it isn't important because someone else has. It is very important!!!!

Posted by: Richard Glaser on March 21, 2007 9:57 AM

It seems like there should be some combination of Terminal commands one can do to hunt for these files...

Is it possible to grep for some specific string to find files that get zero'd (ie, is it literally zeros or some special null character)? Additionally, does the modification date change on the file?

Posted by: heavyboots on March 21, 2007 1:59 PM

Yes and yes. However printing those commands would just cause them to be added to the useless list of voodoo commands people do before and after updates (as seen by the comments on this post). Also as seen by the long list of voodoo rituals as seen on MacFixIt, Apple discussion boards, and MacInTouch. I do not deal in voodoo.

And having this list does you absolutely no good whatsoever if you've been affected by this issue.

Therefore, I will not be printing those commands.

Posted by: Rosyna on March 21, 2007 2:06 PM

help!!!
i just got hit by this _dyld_update_prebinding bug! i wad doing updates and still doing other stuff.

All over a sudden, i find out that i can type any commands on the terminal window anymore.. not even a simple "ls".. it give me a error message:

dyld: corrupt binary, library ordinal too big
Trace/BPT trap


now what should i do?? The update is still going and not finished and seems have been running for a long time already. i cannot even cancel it.. i am still be able to browse the web through, that's how i find out i just SOL and get hit by this bug.. please can someone help me, i dont want to lose any of my stuff on this laptop.

thanks,
tony

Posted by: tony on March 26, 2007 9:38 AM

10.4.9 update killed my MacBook Pro.

12 hours of hell later and I finally got it working.

It involved accessing the drive as firewire slave from another mac by holding 'T' at startup, then copying over 10.4.8 combo update and run that using terminal prompt made available from tiger boot disk.

Something like this:
1. Download the latest Combo Update from Apple, putting it on the internal disk as /tmp/update.dmg
2. Boot from the Install DVD
3. Bring up Disk Utility from the menu
4. Verify the external volume and, after discovering problems, repair the external volume
5. Bring up terminal
6. Mount the update image:
1. /Volumes/Internal/usr/bin/open /Applications/Utilities/Installer.app /Volumes/Internal/tmp/update.dmg
2. Click on the update.dmg in Disk Utility’s left navigator
7. Install the update:
1. /Volumes/Internal/usr/bin/open /Applications/Utilities/Installer.app /Volumes/whatever-it-was-called.pkg
8. Wait a few minutes for the install to finish
9. Reboot

Thanks to this source: http://readthisblog.net/2006/10/

Posted by: John on March 28, 2007 6:47 PM

What about after the update installs but before the computer restarts? If I force quit Software Update when it tells me to restart my computer, and go about my day, will it harm my system?

Posted by: smact on April 1, 2007 4:28 PM

Well, if recent leaked shots of Apple's Software Update are anything to go by, Apple do believe this is a bug and have done something about it. It's just the worst sort of fix, force users to quit all applications before even downloading the updates, let alone appling them.


http://gamenian.blogspot.com/2007/04/background-updating-awol-in-leopard.html

Posted by: Ben on April 15, 2007 2:29 PM

6 hours of re-installing and re-configuring, plus a few more to go- for nothing but an overpriced, slow, flaky computer. Engineers multitask, they don't waste their time waiting for itunes to update. I guess the box would still look good with a frappachino. And on the bright side it does force me to really learn unix (so that I can fix the corrupted file that Mac Tech Support refuses to touch). It's also a great excuse to go buy one of those 750GB drives... though I never thought I'd be needing to backup disks that have nothing wrong with them merely so that I don't waste so much time re-installing the next time my computer breaks itself.

Posted by: Bob on April 26, 2007 12:09 AM

If some updates are SOOO important to apple that I must reboot to complete them (combo updates and Quicktime), then why can't Apple install a temporary boot-up hook to do all the prebinding before the loginwindow appears. That should prevent multiple prebinding instances for happening, if no other processes are running (temporarily at least, they would have complete control over the machine, so would be sure no other processes were running) For everything else, they ought to just relax a little and let the implicit update_prebinding handle it on an as-executed basis.

Posted by: Chris Pragman on May 3, 2007 11:57 AM

Just the time we were expecting MSI style silent updates, Apple updater wants all Apps quit?

I saved a XP SP2 computer (nightmare) just month ago, XP SP2 now has "apply updates before system shutdown" feature. It is very nice for people hating reboot but shutdowns their computer at night.

It could be done if Apple wanted, they wanted easy sounding one instead. Hope it doesn't stay that way since I am not enabling auto updates on any of machines I have access to.

Well time to go back to old fashion download manager dmg downloading :)

Posted by: Ilgaz on May 12, 2007 11:58 AM

Probably I am suffering of this bug. After applying the last security update 2007-004 v 1.1 and quicktime 7.1.6, I no longer can loggin to GUI. After loggin I am put in console Darwin/DSB asking username/passwd. I can only logging to this console mode. Tried about everything suggested out there with no luck so far in finding a solution. I did some 5 times an archive/install and everytime I reach those updates I get this problem. So I gave up applying those updates. If someone knows a solution, other than a complete clean install, let me know.

Posted by: Rudnei on May 23, 2007 6:04 PM

I found this page after googling for a startup problem I am now suddenly encountering on my 5 month old MacBook Pro. And it all happened after an update.

When I attempt to start up and press the power key I hear the drive give a short turn and then whine down. Nothing else happens. No chime, no screen... nothing.

IF I hold down the power button until the indicator lights flash I get a harsh tone and then it does startup.

I've made an appointment with the Genius Bar for Monday, but I'm going to try DiskWarrior 4 today.

Does anyone have any other suggestions?

Posted by: Jennifer on May 26, 2007 4:16 PM

Dear Rosyna,

Before reading your article, I already stopped all applications before starting an update, just to be on the safe side. But I just did an update, and I found that the prebinding phase took so long that the screen saver kicked in. So not only do I need to stop all applications, and not start any application during pre-binding, I also need to disable the screen savers before doing an update?

Chris van Engelen,
Almere, The Netherlands

Posted by: Chris van Engelen on June 24, 2007 5:49 AM

yo! i just ran a 10.4.10 update, i kept working in the foreground, it sked me to restart, i like a cool dude that i think i am, took my time saving and closing 3-4 apps I was working on, restarted and got this black screen.

same problem as most users have been posting! just a black display and even a Command+S bot wont yield anything.

i sit on the net, check all this info out, initiate download of combos and go ack to my Mac, and ee it has booted by now and is asking for my username/pwd

!wow!

i love the Mac!

now i instatly ran disk utilities, permissions repair, disk repair and am VERY scared of rebooting. any suggestions?

Posted by: paramvir singh on June 25, 2007 12:41 AM

Thanks for the info. Two questions:


1. Let's say this prebinding bug happened on a Mac, but it happened to a non-critical system file, so the Mac still boots. Can you check for the bug by simply doing a find on / for files of zero-length?


2. When booting in verbose mode, how can you slow or pause the scroll so that you can actually read what's happening during booting?


Thanks.

Posted by: Britney on July 25, 2007 7:06 PM

Apple should fix MacOSX to use a decent binary format. Mach-O is horribly primitive, and is the only reason that pre-binding is needed at all. A proper executable format that supports position independent code would cure this malaise, and make OSX a generally more efficient OS. Personally, I'd also like to see the demise of the Mach kernel altogether. I think that most people who have benchmarked this would agree that there is sufficient evidence that it does not perform satisfactorily on server, heavily threaded workloads, or on workloads that require high levels of responsiveness (graphics, or close to RT scientific, medical, and I guess gaming)

Posted by: on July 30, 2007 7:56 AM
Post a comment




Remember Me?

(you may use HTML tags for style)