Background / Introduction
The second-generation Apple TV, a digital media receiver made and sold by Apple Inc., was unveiled during an Apple press conference on September 1, 2010. It is a small form factor network appliance designed to play digital content originating from the iTunes Store, Netflix, YouTube, Flickr, MobileMe or any Mac OS X or Windows computer running iTunes onto an enhanced-definition or high-definition widescreen television, and will except music, video and photo streams from other iOS devices using AirPlay in 4.2. The second generation sold 250,000 in its first two weeks available.
Packaged iOS Software
Lowtide is the application running on the AppleTV. It is essentially an updated "FrontRow" system that handles all user interaction, video playback, streaming, etc. It has been shown to run on other iOS hardware such as the iPod Touch.
Size: 23 mm (0.9 inches) (h), 98 mm (3.9 inches) (w), 98 mm (3.9 inches) (d)
Weight: 0.6 pounds
I/O: HDMI, Optical audio, 10/100 Mbps Ethernet, IR receiver, Micro-USB port
- Apple A4 Processor (K4X2G643GE, same as in iPad)
- Samsung K9LCG08U1M 8GB NAND Flash chip
- Broadcom BCM4329XKUBG 802.11n Wi-Fi/Bluetooth/FM chip (Same as in iPad)
- 256 MB RAM
- Apple 343S0479 1005 005BB
- M430 F2350 TI E03K C0GP G4
- SMSC 8710A-EZK B1023-A2 (10/100 Ethernet Transceiver)
- TXC MUGT 27.000
- TXCPCUM3 50.000
- Apple 338S0891
The AppleTV 2 has a predetermined spot on the logic board for an Apple Dock Connector. This is most probably here for Apple's in-house developer units.
The default Apple TV hardware does not allow you to use the HDMI port and the micro-USB port at the same time. Adding an iPod dock to the side of the enclosure will bypass this hardware restriction, allowing both hacking and viewing.
An image of the dock connector spot can be seen in a teardown by iFixit:
Here is a link to some female dock connector parts:
Soldering to the dock terminals on pins 2 and 3 failed to get analog audio out. I don't know if it's a hardware or software limitation. I was able to produce sound out the HDMI port but no sound came out of the dock pins corresponding to audio out on other iOS devices.
Pins 5, 7, 9, 14, 16, 18, 22 and 24 are connected to Ground.
How to DFU Mode
Step 1: Plugin your Apple TV to computer with microUSB (Power cable connected).
Step 2: Hold menu + down button together for 6 secs to reboot.
Step 3: Once your Apple TV reboots immediately hold menu + play together until a message appears in iTunes telling you an Apple TV in recovery mode has been detected.
Note: You must use the new Apple IR remote to do this, the old one does not have the new play button and it will NOT work to enter DFU mode..
How to Install NitroTV
1) SSH into your Apple TV2, the default password is “alpine”
2) Type “passwd” and enter a new password (if you haven’t already)
3) Type: echo “deb http://apt.awkwardtv.org ./” > /etc/apt/sources.list.d/awkwardtv.list
4) Type: apt-get update
5) Type: apt-get install com.nito.nitoTV
6) Type: killall Lowtide
- Complete Proper Headers for OS 4.1
- Sample frappliance template
- New and Improved Sample frappliance
- Dustin Howett's beigelist
- iFixit Teardown
- How to save SHSH blob
- dyldcache listing
- Buildable / linkable sample project for ATV-2 via NitoTV
PwnageTool 4.1.2 uses the limera1n exploit to jailbreak and auto-install SSH and afc2. It also installs parts of Cydia (like apt-get), but a Cydia GUI remains to be developed and deployed. The assumption is that your home network is secure, but it is recommended that you change your root password anyways, which is "alpine" by default. About all you can do now is command line operations via ssh, until developers enable methods to use remotes.
Greenp0ison leverages limera1n exploit and RC5 is being prepared to have AppleTV support. Preview screenshots have been posted by the Chronic Dev Team showing altered menus and a software injector. Preview
- SHAtter Exploit: pod2g's SHAtter exploit has been showcased by MuscleNerd and posixninja as capable of jailbreaking the AppleTV, but this exploit will be with held for a while due to the release of limera1n's exploit, it is mentioned here mainly for posterity.
- Limera1n: geohot has released the limera1n exploit which is capable of jailbreaking the AppleTV, but as of right now it doesn't install afc2 or ssh so it is of little practical use for any average AppleTV user, or even most AppleTV seasoned hackers. It never mounts or installs anything, ostensibly not making any changes at all to the AppleTV filesystem.
We will do our best to keep this page neutral because of the controversy surrounding limera1n and the various development teams, please if you add to this page, do the same.
3rd Party Apple TV iOS Software
- Fire Core, a software development group who have released software for the Apple TV (1st Gen), is actively working on a product aTV Flash black and a corresponding SDK.
- NitoTV, a popular application for the original Apple TV, may be the first app running on the new Apple TV.
The above sample code requires Dustin Howett's beigelist frappliance. This section initially housed a change that was necessary to get the beigelist frappliance to work, with the latest updates from DHowett, the changes are no longer needed. Additional developer notes will be added to this section pending their noteworthiness.
Follow this page for any updates, it will be more inclusive of information time pending, as it arises.
Notes from nunux77
To be able to run your test application, like the NitoTV "Hello World" example, you need to install Dustin Howett's beigelist. I had some issues and do dirty fix to compile the lastest version, but you can now get directly the cydia package on NitoTV repository to save some solving time about compilation. Just follow the instruction to install NitoTV, and it will install beigelist as a dependency.
Thank a lot to Nito, Dustin and the community for your support.