June 20 2007 Patch (aka the YouTube Patch)

From AwkwardTV
Jump to: navigation, search


As described in the Patch Over Network article, the AppleTV goes out to mesu.apple.com perodically and checks for updates, much like Software Update on "real" OS X works. Apple TV weekly checks for updates, if it finds the new update it will be installed automatically and will remove any modifications (to avoid auto-update add the line mesu.apple.com to /etc/hosts)!

The DMG is accessible from http://mesu.apple.com/data/OS/061-2988.20070620.bHy75/2Z694-5248-45.dmg. It weighs in at 179MB (188,072,708 bytes)

There is an article about the security content of the Apple TV 1.1 update on apple.com: http://docs.info.apple.com/article.html?artnum=305631 The update solves a security problem with UPnP (A remote attacker may be able to cause a denial of service or arbitrary code execution).

**Forum discussions are located here"**

Full file listing of the disk image

file list is here

What has changed in the update from the original vanilla factory image?

Diff file is here

Added Items

  • A new appliance with YouTube integration: YT.frappliance.
  • A new screensaver: slideshow.frss.
  • A new version of BackRow.framework, now updated to version 2.1 (seems to be the one used in the WWDC Leopard release).
  • A new framework, AppleTV.framework, containing everything AppleTV-specific from BackRow version 2.0 (screensavers, hardware, sw update).
  • A new feature called Parental Controls in the settings menu, to disable things like YouTube (could this be used to remove other features from the main menu?)

Removed Items

  • Most of the OS X installation is gone: LoginPlugins, OpenDirectory plugins, Printing support frameworks, many support apps and suchlike.
  • All remote filesystem support is gone: automount, mount_afp, mount_smbfs, mount_webdav, etc.
    • The binaries are gone and internal kernel support as well. Replacing the mount_afp from the pre-patch and trying to mount a share throws an error.
mount_afp: AFPMountURL returned error 22, errno is 2
  • AppleFileServer is gone. The symlink in /usr/sbin remains, but the app in /System/Library/CoreServices is gone.
    • A simply copy over of the AppleFileServer.app from the recovery partition gets it back up and working.
    • To restore the AppleFileServer.app do the following:
sudo mount -o remount,rw /dev/disk0s3 /
cd ~
mkdir mnt
sudo mount -t hfs /dev/disk0s2 mnt
hdiutil attach mnt/OS.dmg
sudo cp -R /Volumes/OSBoot\ 1/System/Library/CoreServices/AppleFileServer.app /System/Library/CoreServices
hdiutil detach /Volumes/OSBoot\ 1/
sudo umount mnt
rmdir mnt
sudo mount -o remount,ro /dev/disk0s3 /
  • After the update you will also need to modify /etc/hostconfig. Within hostconfig AFPSERVER=-YES- instead of NO has to be set.

Dr Omega 01:15, 26 June 2007 (CEST)

  • VNC
  • Changes to Watchdog. Unloading com.apple.driver.AppleTCOWatchdog and stopping ripstop will likely get your @tv rebooting every 5 minutes or so. Keep-alive commands sent by Applications Menu may also not be processed correctly.

( On line above "sudo mount -t hfs /dev/disk0s2 mnt" had to mount disk readonly first using "sudo mount -t hfs -r /dev/disk0s2 mnt" )

Tweaking Plugins to work with BackRow v2.1

Two things must be changed to make appliance plugins compatible with BackRow v2.1:

  • Change the CFBundleIdentifier in your appliance's Info.plist so it begins with "com.apple.frontrow.appliance".
  • Change the fake class name returned from the +className override to something like "RUIMoviesAppliance".

In the new version of the BackRow framework, there is a new class called BRFeatureManager. This uses strings to record whether certain features are enabled or disabled (the strings/keys are entirely arbitrary btw, so we can use this ourselves). I believe this is mostly designed to enable parental controls, but the part of the implementation as it concerns the main menu now filtering appliances goes like this:

  1. BRFeatureManager looks up the given 'key', which in this case is an appliance plugin's CFBundleIdentifier.
  2. If the key is present in the feature dictionary, it returns the YES or NO depending on the object for that key (an NSNumber).
  3. If the key is not present, it checks whether the key begins with "com.apple.frontrow.appliance".
  4. If it does, the manager returns YES, enabled. Otherwise it returns NO, not enabled.

So, it looks like the simplest way to get past the new BRFeatureManager in a backward-compatible way is simply to change your bundle identifiers. The other alternative is to add this initialize function to your principal class:

+ (void) initialize
    Class cls = NSClassFromString( @"BRFeatureManager" );
    if ( cls == Nil )

    [[cls sharedInstance] enableFeatureNamed: [[NSBundle bundleForClass: self] bundleIdentifier];

What is known about the update so far

  • It will erase any modifications you've made to the Apple TV OS such as installing SSH, AFS, and special network mounts, however your Media partition will stay intact.
  • All plugins will need to be tweaked and recompiled to work under the new firmware due to changes in the BackRow Classes.
  • The firmware update seems to contain everything you would need to make your own Patchstick legally without having to open up your Apple TV. It may also be possible to do a DNS Redirection for the update server url and point the Apple TV to your own customized filesystem updating the ATV over the network with an OS that has all of your plugins and settings pre-installed. However, according to the Apple announcement ATV will verify a signature, so probably it will not be that easy.
  • Most network filesystem support has been removed
  • The update includes some new code called: 'RUIDVDAppliance' This could mean a HD DVD / BlueRay addon for Apple TV is in the works?!?
  • There appears to be support for pin-code protected parental controls
  • The patch does *not* change your recovery partition. If you do a full factory restore after downloading and installing the patch, the device will boot back into 1.0 software upon completion (This has been confimed by ProfessaFresh, Galphanet and skoops).
    • New AppleTVs have shown up with 1.1 preinstalled and on the recovery partition. More. --Yargok 16:31, 17 August 2007 (CEST)
  • Patchsticks don't work anymore (mounting OSBoot partition r/w seems to have failed). ( it is still working here. But I had to put sudo in front of every command. timitw) ( Just got a ATV with 1.1 and 1.1 recovery. The patchstick worked but installed ssh only.)

Safe Update

The update patch removes several features including Apple File Sharing and other network functionality. Other than the items listed below the update doesn't seem to have any other enhancements. With the update you also lose all customizations and hacks. An alternative method can be used for updating. Using this method will preserve all your hacks and changes to the system. The plugins wil have to be added again.

 0. Don't update the AppleTV using the update feature
 1. Backup /System/Library/PrivateFrameworks/Backrow.framework
 2. Backup /System/Library/PrivateFrameworks/iPhotoAccess.framework 
 3. Backup /System/Library/CoreServices/Finder.app
 4. Download the update dmg file from the link above
 5. Open the dmg file and locate Backrow.framework, iPhotoAccess.framework and AppleTV.framework 
 6. Copy them to /System/Library/PrivateFrameworks on AppleTV
 7. Locate Finder.app from the updates dmg and copy it to /System/Library/CoreServices on AppleTV
 8. optional - insert       mesu.apple.com in the /etc/hosts on AppleTV so it can't reach the update server

If you don't know how to carry out the above instructions you can follow the Safe Update step by step guide.

If your system has already been updated you should be able to do a factory restore, patch the system again to get ssh then the follow the above steps, that way you will not lose the network connectivity and other features that have been removed.

Fixing Sleep Issue

UPDATE: If you are having problems sleeping your ATV after the safe update make sure the SettingsHelper inside the AppleTV.framework has the right permissions and owners. You should have the following: (exluding the date and time of course which will be different)

 -rwsr-xr-x 1 root wheel 51268 Mar 14 19:51 SettingsHelper

to get the appropriate permissions you may need to do the following

 sudo chmod u+s /System/Library/PrivateFrameworks/AppleTV.framework/Resources/SettingsHelper

if the owners are wrong you will need to do the following to correct them

 sudo chown root:wheel /System/Library/PrivateFrameworks/AppleTV.framework/Resources/SettingsHelper

Quickly Switching between old (1.0) Finder and new (1.1) Finder

---NOTE: This is an optional thing, has nothing to do with the update above infact this can be run on all full update if you preserve the files from 1.0

---NOTE: You need to do this only if you need to run the old Finder for some reason.

---NOTE: Now that the most major plugins have been updated there is no reason to do this.

 1. Copy or rename the old(1.0) BackRow.Framework to /System/Library/PrivateFrameworks/BackRow.framework.1.0
 2. Copy or rename the new(1.1) BackRow.Framework to /System/Library/PrivateFrameworks/BackRow.framework.1.1
 3. Copy or rename the old (1.0) Finder.app to /System/Library/CoreServices/Finder.app.1.0
 4. Copy or rename the new (1.1) Finder.app to /System/Library/CoreServices/Finder.app.1.1
 5. Make sure you don't have a Finder.app or BackRow.Framework the following scripts will create symlinks for you

To run the old(1.0) Finder run this script

 rm   /Volumes/OSBoot/System/Library/CoreServices/Finder.app
 ln -s /Volumes/OSBoot/System/Library/CoreServices/Finder.app.1.0   /Volumes/OSBoot/System/Library/CoreServices/Finder.app
 rm   /Volumes/OSBoot/System/Library/PrivateFrameworks/BackRow.framework
 ln -s /Volumes/OSBoot/System/Library/PrivateFrameworks/BackRow.framework.1.0  /Volumes/OSBoot/System/Library/PrivateFrameworks/BackRow.framework
 ps ax | grep 'Finder' |awk '{print $1}' |xargs kill

To run the new(1.1) Finder run this script

 rm   /Volumes/OSBoot/System/Library/CoreServices/Finder.app
 ln -s /Volumes/OSBoot/System/Library/CoreServices/Finder.app.1.1   /Volumes/OSBoot/System/Library/CoreServices/Finder.app
 rm   /Volumes/OSBoot/System/Library/PrivateFrameworks/BackRow.framework
 ln -s /Volumes/OSBoot/System/Library/PrivateFrameworks/BackRow.framework.1.1  /Volumes/OSBoot/System/Library/PrivateFrameworks/BackRow.framework
 ps ax | grep 'Finder' |awk '{print $1}' |xargs kill

You must be root and the system must be rw for these scripts to work.