Note: Please see a more recent post on Apple TV hacks.
After lots of research and some experimenting, I have finally hacked my Apple TV.
I read about the several ways to hack the Apple TV by cracking the case and pulling out the hard drive, but I didn’t want to go through this hassle and also void the warranty. Then I read about folks who have found a way to install software on a flash drive, called a “patchstick.” This method allows you to insert the patchstick into the USB port of the Apple TV and reboot. The patchstick installs the necessary files for enabling SSH on the Apple TV. With SSH enabled, you have the ability to install other applications from a remotely connected computer.
There are a few ways to create a patchstick. Some are quite involved, and require a comfortable familiarity with command line navigation in Terminal. Oddly enough, the easiest method I found to create a patchstick was done by some PC folks, and requires access to a machine running Windows. Since I am running Windows (via Parallels) on my MacBook Pro, this was not a problem.
For a detailed explanation on how to create a patchstick on Mac OS X (intel), go to this page on the AwkwardTV wiki: PatchStick
The above method was a bit too involved for my taste.
Creating A Take2 PatchStick
Requirements:
- Windows operating system
- DD for Windows (download here)
- PatchstickATVT2 (download here)
- StuffIt Expander (download here)
- 1GB (or more) thumb drive
Note: Make sure your Apple TV is updated to at least 2.01
Step 1
Decompress the files. The DD file is in .zip format, and the PatchstickATVT2 file is in .rar format. Both files will decompress using the StuffIt Expander by double-clicking. The PatchstickATVT2.rar file will decompress to PatchstickATVT2.img.bz2. Double-click this again to end up with the PatchstickATVT2.img file.
Step 2
Copy the PatchstickATVT2.img and dd.exe files to a folder on your Windows machine.
Step 3
In Windows, enter into a command line mode by selecting Run form the Start menu and typing “cmd”. Navigate to the folder with your files typing at the prompt:
cd C:\NameOfFolder
Insert your USB thumb drive. Then, type the following to get a list of all mounted drives:
dd --list
This will show you all drives and their drive numbers. The listing should look something like this:
\\.\Volume{e3429891-0eb9-11da-b18f-000d60dc98cd}\
link to \\?\Device\Harddisk4\DP(1)0-0 3 removable media
Mounted on \\.\d
You want to find the drive number for your thumb drive.
Note: Make sure you have the correct drive number for your thumb drive. If you get this wrong, your risk deleting your Windows hard disk partition!
Step 4
Once you have the correct drive number for your thumb drive, type the following command:
dd if=PatchstickATVT2.img of=\\?\Device\Harddisk*HARD-DISK-NUMBER-HERE*\Partition0 bs=1M --progres
For example:
dd if=PatchstickATVT2.img of=\\?\Device\Harddisk4\Partition0 bs=1M --progress
You will see the script running in the command window. It generally takes a few minutes.
Step 5
Once the script has finished, plug the thumb drive into the USB port on your Apple TV and reboot by holding down the “-” and Menu buttons simultaneously.
Once rebooted, you will be able to SSH into your Apple TV by issuing the following command in your Terminal window on a Mac:
ssh frontrow@YourAppleTV-IP-address
When prompted for a password, use “frontrow”.
SSH Is Now Enabled
With SSH now enabled, you may begin at add functionality to your AppleTV. In my next post, I will go through the steps of loading an internet browser that allows you to navigate the web freely. I will also show you how to enable the Flash and QuickTime plugins so you can watch movies from any site on the web.
OSBoot As Read-Only
One thing we’ve already learned from SSH is that the root filesystem on the Apple TV (aka OSBoot) is apparently mounted as a read-only filesystem. That means it’s not initially possible to copy any files to the root mount point (/etc, /usr, /var, for example) while it is running. You can remedy this with:
sudo mount -uw /
UPDATE:
It’s possible that this procedure can be done on a Mac using Carbon Copy Cloner to clone the PatchstickATVT2.img file onto a USB thumb drive. I will experiment with this method and report back here.
