How to Create a Bootable Kali USB Drive on Mac OS Sierra

Welcome to Part 1 of my Tutorial on how to do a dual boot installation of Kali Linux on your MacBook Pro running Mac OS Sierra. In my tutorial I’m using a 13-inch MacBook Pro with TouchBar (Late 2016), so depending on your model and Mac OS version, things might be different for you.

Before we get started, please note that you should probably create a backup of your system before you go all the way and install Kali as your second OS on your system. The easiest way to do so is probably Time Machine in combinations with Apple’s Time Capsule. You can just use an external HDD or, like I did, use your existing NAS for your Time Machine backups.

The first step of this tutorial is probably the easiest. We are going to create a bootable Kali Linux USB thumb drive, from which we are going to run the actual installation on a secondary partition later on.

Since I also recorded the process, you can either just watch the video below for most of this guide, or scroll down and continue with the written version. In my opinion, you are probably faster with the written version, since there is really not much to it.

So let’s get to it. What you want to do first is download an up to date image of Kali Linux (straight from there server or using a torrent client like uTorrent). You can find a list of images at https://www.kali.org/downloads/.

Once that’s done, you should have your Kali Linux image waiting in your downloads folder. Go ahead and open a terminal and navigate there using the following command.

cd Downloads

Next, plug in your USB thumb drive and either use the Disk Utility app as shown in the screenshot a little bit further below or the following command in terminal to figure out where your thumb drive got mounted.

diskutil list

This is going to cause an output similar to this:

JordanBelfort87-MacBookPro:Downloads rauchenwaldc$ diskutil list
/dev/disk0 (internal):
#: TYPE NAME SIZE IDENTIFIER
0: GUID_partition_scheme 251.0 GB disk0
1: EFI EFI 314.6 MB disk0s1
2: Apple_CoreStorage Macintosh HD 250.0 GB disk0s2
3: Apple_Boot Recovery HD 650.0 MB disk0s3

/dev/disk1 (internal, virtual):
#: TYPE NAME SIZE IDENTIFIER
0: Macintosh HD +249.7 GB disk1
Logical Volume on disk0s2
D0597E73-06E3-44BA-A4C1-DF5F53DA89AE
Unlocked Encrypted

/dev/disk2 (external, physical):
#: TYPE NAME SIZE IDENTIFIER
0: FDisk_partition_scheme *16.1 GB disk2
1: 0x17 3.0 GB disk2s1
2: DOS_FAT_12 NO NAME 110.1 MB disk2s2

Then, you need to spot your thumb drive. In the case above it’s /dev/disk2 (external, physical). If you are not sure you may use the Disk Utility tool as mentioned above. Your thumb drive should be listed on the left-hand side and once you click on it you will be able to see the device in the bottom right corner.

Now we are almost there. The next thing we need to do is unmount our thumb drive, using the following comment:

diskutil unmount /dev/disk2

Note: If you get an error like “disk2 was already unmounted or it has a partitioning scheme so use “diskutil unmountDisk” instead” you need to adjust the command according to the message shown.

diskutil unmountDisk /dev/disk2

Important: Make sure to replace /dev/disk2 with your device!

We are almost done, all we need to do now is write the image to thumb drive.

sudo dd if=kali-linux-2016.2-amd64.iso of=/dev/disk2 bs=1m

Note: The ‘bs’ (blocksize) parameter, among other factors, is going to affect how long it’s going to take to write the image to your thumb drive. ‘1m’ is the value recommended in the Kali Linux documentation but you might have more success with different values like ‘512’.

In order to execute the command above, terminal is going to ask you for your password since we are using ‘sudo’ to execute the ‘dd’ command with superuser privileges. When you enter it, the terminal won’t show any input. That’s totally normal, so just confirm your password by pressing the return key.

Depending on the selected blocksize and several other factors like the connection type of your USB thumb drive, the process is going to take some time and it’s not going to give you any feedback until it’s done.

2934+1 records in
2934+1 records out
3076767744 bytes transferred in 872.584156 secs (3526041 bytes/sec)

That’s it. You’ve successfully created a bootable Kali Linux USB thumb drive, or at least according to the official Kali documentation. Unfortunately, this might already be enough to later boot and install Kali on older MacBook’s, but it doesn’t get the job done on the late 2016 models like mine.

Note: If you are using an earlier model move on to the rEFInd installation and only consider the following steps in case you are unable to boot Kali later, since those steps might not be necessary for you.

Error’s you are going to encounter if you use the USB flash drive like it is now depend on how you are trying to boot.

If you use the built in Mac OS boot manager by holding the Alt key while booting you are most likely just getting a blank black screen after selecting to boot from USB.

In case you already installed rEFInd, you are going to either end up with a black screen or something like…

You might even be able to see some items in the boot menu, but you are going to get stuck once you select something. In order to fix this, we need to adjust some configuration files on the USB drive first.

Here’s the list of files we need to modify in order to deal with the issues mentioned above. All of them are located at /EFI/BOOT/ on your Kali USB drive.

Let’s start with /EFI/BOOT/syslinux.cfg 

Here, we want to change line #2 from

default vesamenu.c32

to

default menu.c32

This switches the bootmenu from the graphical one displayed in the photo above to a retro one. Since this one is better scaled, it’s easier to read and navigate. Unfortunately, this still won’t get your USB drive to boot, so next we continue with /EFI/BOOT/stdmenu.cfg

Changes here would be an alternative to the changes above and are supposed to get the modern boot menu to scale better (didn’t test it without the changes to syslinux.cfg). So your stick might work without those changes too, but since I had the changes in my final setup, I’d recommend you copy them as well. Not gonna post them seperate as code here, since all you have to do is place a in front of a few lines as you can see on the screenshot above in order to make them a comment and therefore ignored by the bootmenu.

Now, let’s move on the final and most crucial change in order to get your USB drive to boot properly. Depending on which option of the boot menu you want to use, you need to adjust a different file.

In order to be able to launch “Kali Live” from the bootmenu, you need to adjust /EFI/BOOT/live.cfg adding the parameter nointremap as shown in the image below.

Note: If you want to use the other live options you may add the parameter in the corresponding lines as well.

If you want to run “Kali Installer” from the bootmenu, you need to modify /EFI/BOOT/install.cfg just like you just did before and add the parameter nointremap to the “install” and “installgui” block.

Last but not least, you need to edit /EFI/BOOT/isolinux.cfg 

Same as with syslinux.cfg, you want to switch to the old school blue and white boot menu by changing the second line from

default vesamenu.c32

to

default menu.c32

 

That’s it. Now you’ve created yourself a bootable USB thumb drive that can be used with your 13″ MacBook Pro (Late 2016 with Touch Bar). So, in theory, you could now just follow the rest of the official Kali documentation.

Well, almost. Unfortunately, the official documentation shows you how to install rEFInd in version 0.8.3 which doesn’t work anymore since changes Apple introduced with OS X Yosemite quite some time ago. So you’ll have to use a newer version of rEFInd. By the time of writing this post the current version was 0.10.4. Unfortunately the structure of this version is slightly different so you won’t have any success by following the steps shown in the official Kali documentation blindly since the file /install.sh doesn’t exist in newer versions anymore.

But no need to worry, just check out my “How to install rEFInd 0.10.4 on your MacBook Pro” post to get this done as well.

If you got questions regarding this tutorial or suggestions on how to improve it, feel free to leave them in the comment section below.