Open Firmware - joe-possum/machines GitHub Wiki
To access Open Firmware on a Power Macintosh, hold down the Command-Option-O-F key combination immediately after turning on the computer until you see the Open Firmware prompt.
On Power Macintosh the default Open Firmware console will be modem serial port, 38400 baud, even, no parity.
In the OF prompt, the ' (yes, a single apostrophe) command looks up the command in front of it and puts its address on the stack.
' shut-down .
This sequence looks up the address of the shut-down command and displays its address.
To get the address of the boot rom, type
dev /rom ls
You should see an entry that looks like boot-rom@ , with some number after the @ sign. That number is the starting virtual address of the boot rom. If you want the physical address, use the virt->real command to translate it.
To dump the rom, make sure you are saving a telnet log. Type the virtual address of the rom, followed by
o over - dump
. You will get a very very long hex dump that ends with an error. Use some kind of automanted script on the telnet log to get the binary file. You do not want to type it in by hand.