I'll add an addendum to the blog post at some point with a more detailed method because there is demand, but the tl;dr is:
- boot macos under hypervisor (detailed guide in my part 1) into single user mode
- write your own metal program and run it as early in boot as you can
- trace all relevant graphics regions
- once you see the first kick, intercept that kick, then capture the full uat state
- reboot the device, then copy that whole uat state back into the machine, every bit exactly where it was
- perform the kick, verify the output page changes as expected
- have the LLM build all the objects itself in python
- repeat with different metal programs until we have all the behavior you want
- for a list of all behaviors you want, just look at the m1/m2 kernel driver and make sure everything they do has an analogue in your codebase
- if there's every any problems, there's a very simple debugging loop: 1. MAKE SURE YOU HAVE A REPLAYABLE CAPTURE. if you don't then priority #1 is to get that capture. once you have that capture, it's only a matter of time until it works
I guess its a good reason to try it with M6 mac mini or Vision Pro then (yeah I know AVP has locked bootloader). Thanks.