Apple TV Hacking

From Bubba.org

Forward

It should be noted that I no longer use the method below for updating Apple TV's since I've moved to the ATV Bootloader Patchstick Method which allows me to do almost everything here via a USB Patchstick. The documentation below is still rather accurate with regards to obtaining the software, but keep in mind that this can all be done with a properly created Patchstick. Sadly, since many of the files required for patching Apple TV's are not GPL licensed, I cannot provide them here. If you would like to get started, you could download a basic ATV Linux Bootloader Patchstick for patching SSH that was posted in one of the forums I'm on (see directions below on how to install). I do not endorse this file or it's creator, nor will I provide support for helping with it, but it does do a good job of showing how patching is done by enabling SSH on an Apple TV and I have verified that it doesn't do any bad stuff to a machine. The files mentioned below can be easily added to this type of Patchstick by following the same format.

Introduction

These instructions will allow give your AppleTV (version 2.1) the ability to play DivX, WMV, etc locally or over a network share (afp - other mounts, smb, nfs, etc are supported but not covered. see http://wiki.awkwardtv.org/wiki/Mount_a_Remote_Drive_via_SMBFS for SMBFS mounting since it will already be configured with the installation of NitoTV) via ATVFiles (or NitoTV or Sapphire). Each of these will allow you to play your own movies and each has different features. You will also have the ability to surf the web via CouchSurfer.

No functions are removed from your ATV so you should still be able to use it to sync iTunes, purchase/rent movies, or use YouTube.

You will also have the ability to backup your AppleTV and enable ssh on it.

Instructions

Backup partitions using ATV bootloader/ATVbackup

http://code.google.com/p/atv-bootloader/wiki/ATVBackup (using atv-bootloader)

(or use the ATV Linux Bootloader Patchstick above but move the patchstick.sh file out of the way, thus the telnet server will start instead of the ATV being patched). You will need a 2GB or greater USB drive.

$ bunzip atv_lnx_ps_lite-2GB.img.bz2
$ sudo dd if=atv_lnx_ps_lite-2GB.img of=/dev/disk2 bs=1M
$ cd /Volumes/Patchstick
$ mv patchstick.sh patchstick.sh.bak

Follow the ATVBackup instructions or these instructions to backup all partitions: http://wiki.awkwardtv.org/wiki/Backup_your_original_Hard_Drive

Note, only Partitions 1, 2 are needed to recover your ATV to factory state. Partition 3 is current configuration of the OS while partition 4 is your media.

Reboot by pressing - & menu at the same time and holding. Machine should reboot and show command line text. Once the text stops, I had to remove the usb drive and re-insert it for the patching process to proceed.

Do patchstick to enable ssh

Use the ATV Linux Bootloader Patchstick from above. If you backed up your ATV first, then you simply need to move patchstick.sh back:

 $ cd /Volumes/Patchstick
 $ mv patchstick.sh.bak patchstick.sh

Otherwise, you'll need to create this patchstick using a 2GB or greater USB drive.

 $ bunzip atv_lnx_ps_lite-2GB.img.bz2
 $ sudo dd if=/dev/zero of=/dev/disk2 bs=1M 
 $ sudo dd if=atv_lnx_ps_lite-2GB.img of=/dev/disk2 bs=1M

Copy required files to AppleTV

Obtain these 2 files for use with NitoTV auto-patching of mach_kernel to support all the features available in the 1.0 software.

 $ scp MacOSXUpdCombo10.4.9Intel.dmg and recovery.dmg to frontrow@appletv.local:~ 
 $ mkdir Documents
 $ mv MacOSXUpdCombo10.4.9Intel.dmg recovery.dmg Documents

recovery.dmg is the 2nd partition off of a 1.0 appletv. It is recommended if you have an AppleTV that came preinstalled with anything newer than 1.0 (you would know this because OS.dmg on the 2nd partition will be < 180MB if the versions are newer). You want version 1.0 OS.dmg (MD5 (OS-dot-DMG 1.0.dmg) = 55b909196952ff72c93aaf3553cf661e) because it has things that later versions do not. Since we'll be pulling things from this recovery location, it is easier if you have it handy. Steps for downgrading your recovery partition are available here: http://forum.awkwardtv.org/viewtopic.php?f=13&t=839

Repair Permissions, Make Disk RW, Reboot

$ sudo mount -uw /
$ sudo touch /.readwrite
$ sudo /usr/sbin/diskutil repairPermissions /
$ sudo reboot

Install NitoTV & ATVFiles

http://forum.awkwardtv.org/viewtopic.php?f=6&t=1262

 $ wget http://nitosoft.com/nitoTVInstaller_tt.zip 
 $ unzip nitoTVInstaller.zip
 $ cd nitoTV*; sudo ./installme
 $ sudo /System/Library/CoreServices/Finder.app/Contents/PlugIns/nitoTV.frappliance/Contents/Resources/fixPerm

scp to appletv and run "installme".

NitoTV should be installed even if you dont plan to use it to view movies since it has a Smart Installer which does a kernel hack that allows you to load kernel extentions, thus giving you the ability to use USB drives, keyboards, etc.

From the AppleTV menu go to nitoTV -> Settings -> Install Software. Perform in this order:
1. Perian, say NO when asked to use Perian h.264 instead of Quicktime's
2. mplayer codecs
3. Turbo's Kextloader
4. Smart Installer (not the updater) - MacOSXUpdCombo10.4.9Intel.dmg and recovery.dmg must be placed in /Users/frontrow/Documents/ on your AppleTV.

ATVFiles information is here: http://wiki.awkwardtv.org/wiki/ATVFiles. Download URL for current version is here:

$ ssh frontrow@appletv
$ wget http://ericiii.net/sa/appletv/ATVFiles-1.1.1.run
$ sh ./ATVFiles-1.1.1.run

Disable Updates

Change /etc/hosts entry for mesu.apple.com to 127.0.0.1

Install CouchSurfer Plugins

http://wiki.awkwardtv.org/wiki/Couch_Surfer#Adding_Plug-In.27s_.28AppleTV.29

Enabling things like flash and quicktime is acutely fairly easy but you will need a few files. You can get the plugins off of a Leopard 10.5 install but you will need frameworks from 10.4. Also the needed frameworks are not in the Combo update, so you will need the install CDs or a booted OS 10.4 system.

1) Copy over any plugins from /Library/Internet Plug-Ins/*.plugin that you want to have. I have tested Quicktime and Flash and can confirm that they work. Note: You need the .plugin versions, there may also be .xpt plugins but these are for Firefox and will be of no use.

You will need to create a /Library/Internet Plug-Ins/ folder on the AppleTV and put the files there.

 /Library/Internet\ Plug-Ins/Flash\ Player.plugin
 /Library/Internet\ Plug-Ins/QuickTime\ Plugin.plugin

2) Locate the proper CoreAudioKit Framework. I used the one off of my OSX 10.4.10 install disk. To extract this framework extract the /Volumes/Mac OS X Install Disc 1/System/Installation/Packages/Essentials.pkg/Contents/Archive.pax.gz archive and then copy ./System/Library/Frameworks/CoreAudioKit.framework from the archive to your AppleTV. Finally move the framework to our /System/Library/Frameworks Folder.

Install Unix Tools

http://wiki.awkwardtv.org/wiki/Apple_TV_Binaries

Enable cron via /etc/rc.local. rc.local should look like this after NitoTV install:

 /sbin/turbo_kext_enabler.bin
 /sbin/kextload -v /System/Library/Extensions/msdosfs.kext
 /sbin/kextload -v /System/Library/Extensions/IOUSBMassStorageClass.kext
 /sbin/kextload -v /System/Library/Extensions/AppleSMBIOS.kext
 /sbin/kextload -v /System/Library/Extensions/IOSCSIArchitectureModelFamily.kext
 /sbin/kextload -v /System/Library/Extensions/IOStorageFamily.kext
 /sbin/kextload -v /System/Library/Extensions/smbfs.kext
 /sbin/kextload -v /System/Library/Extensions/udf.kext
 /sbin/kextload -v /System/Library/Extensions/IOBluetoothFamily.kext
 /sbin/kextload -v /System/Library/Extensions/IOBluetoothHIDDriver.kext
 /sbin/kextload -v /System/Library/Extensions/IOHDIXController.kext
 /sbin/kextload -v /System/Library/Extensions/ntfs.kext
 # enable cron
 /usr/sbin/cron

Fix Kerberos

1) Copy /System/Library/Frameworks/Kerberos.framework from the MacOSXCombo10.4.8Intel.pkg to your AppleTV home directory. (Use Pacifist to extract it)

2) create the /System/Library/Frameworks/OSXFrames directory

   $ sudo mount -uw /
   $ sudo mkdir /System/Library/Frameworks/OSXFrames

3) Copy Kerberos.framework from your AppleTV home directory to the OSXFrames directory

   $ sudo mv Kerberos.framework /System/Library/Frameworks/OSXFrames/
   $ ls /System/Library/Frameworks/OSXFrames/
   /System/Library/Frameworks/OSXFrames/Kerberos.framework

4) On the AppleTV run the sed command.

   $ sudo sed -i"" -e 's;^exec;DYLD_FRAMEWORK_PATH="/System/Library/Frameworks/OSXFrames" exec;' /usr/libexec/sshd-keygen-wrapper

5) mount the recovery partition

    $ sudo hdiutil mount ~/Documents/recovery.dmg
    $ sudo hdiutil mount /Volumes/Recovery/OS.dmg

6) copy the Kerberos.framework from your recovery image to the proper directory (Note: I have a 1.0 recovery partition, a 1.1 may not work)

   $ sudo cp -pr /Volumes/OSBoot\ 1/System/Library/Frameworks/Kerberos.framework /System/Library/Frameworks/
   $ sudo cp -pr /Volumes/OSBoot\ 1/Library/Receipts/* /Library/Receipts/
   $ sudo cp /Volumes/OSBoot\ 1/usr/sbin/mount_afp /usr/sbin

7) repair permissions

   $ sudo /usr/sbin/diskutil repairPermissions /

8) Mount the shared drive

   $ mount_afp afp://username:password@myMac.local/SharedDrive ~/MountPoint

Enable VNC

Get RemoteManagement from OS1.0.dmg. Covered via updated patchstick. You'll need set the password and run the commands below the password)

  $ sudo mount -uw /
  $ sudo touch /.readwrite
  $ cd ~
  $ sudo dd if=/dev/disk0s2 of=recovery.dmg bs=1m 
  $ sudo hdiutil mount recovery.dmg
  $ sudo hdiutil mount /Volumes/Recovery/OS.dmg
  $ sudo cp -pr /Volumes/OSBoot\ 1/System/Library/CoreServices/RemoteManagement/ /System/Library/CoreServices/
  $ sudo cp -pr /Volumes/OSBoot\ 1/System/Library/Perl/ /System/Library/Perl/
  $ sudo cp -pr /Volumes/OSBoot\ 1/System/Library/Perl/Extras/5.8.6/* /System/Library/Perl/5.8.6/

  $ echo 71463E00FFDAAA95FF1C39567390ADCA > /Library/Preferences/com.apple.VNCSettings.txt
 (password frontrow)
 
  $ sudo /System/Library/CoreServices/RemoteManagement/ARDAgent.app/Contents/Resources/kickstart -configure -clientopts -setvnclegacy -vnclegacy yes
  $ sudo /System/Library/CoreServices/RemoteManagement/ARDAgent.app/Contents/Resources/kickstart -activate -configure -access -on -users frontrow -privs -all -restart -agent -menu

Start VNC:

 $ sudo /System/Library/CoreServices/RemoteManagement/AppleVNCServer.bundle/Contents/MacOS/AppleVNCServer

Enable Composite Video

Only needed if you don't have HDMI or Component outputs. This is to obtain color video.

Obtain software: http://forum.awkwardtv.org/download.php?id=30&f=13 and http://forum.awkwardtv.org/download.php?id=32&f=13 (assuming you have NTSC), extract them both the run compile.
Connect video to green connector on ATV.
Login to ATV, sudo vi /etc/rc.local and add this line:

    /sbin/kextload -v /System/Library/Extensions/TVComposite.kext

Run the same command command with sudo:

    sudo /sbin/kextload -v /System/Library/Extensions/TVComposite.kext

Run this command (you need to obtain displayutil as well):

     kill `ps awx | grep [F]inder | awk '{print $1}'`; sleep 1; displayutil -r800x600 -b32

Select 480i.
Reboot. You shouldn't have to do anything else or enter the above command again.

Install sabnzbd (usenet downloader)

The version you install must be compiled for Tiger. Versions from http://www.br41n.com are. You'll need to open SABnzbd.app/Contents/Info.plist and add a key for LSUIElement=1

    	<key>LSHasLocalizedDisplayName</key>
    	<false/>
    	<key>LSUIElement</key>
	<string>1</string>
	<key>NSAppleScriptEnabled</key>
	<false/>

You'll also need to edit SABnzbd.app/Contents/Resources/sabnzbd.ini and set:

  autobrowser = 0 
  host = your_ip_address

You can obtain your AppleTV's ip via the command: ifconfig

Use this script to start on boot (relies on cron being installed):

  #!/bin/sh
  if ! ps -auxwww | grep -v grep | grep SABnzbd > /dev/null
  then
          open /Users/frontrow/Applications/SABnzbd.app
  fi

  $ crontab -l
  @reboot /Users/frontrow/Applications/SABcheck.sh

(note, this doesn't appear to work; probably need a StartupItem instead).

What now?

Well, you can now play most video formats. One thing that is lacking is the proper CPU to play High Profile H.264 content. I recommend that you transcode your video with VisualHub set for AppleTV 5.1+2.0 (if there is AC3 present) with the advanced features of 1280x720 at 5-8Mpbs. These should play fine over 802.11n or wired network. The quality of Main Profile H.264 does not suffer in comparison to High Profile; it is just that High Profile and the advanced features can give the same quality in a smaller file size so your transcoded files will be larger.

Navigation