From AwkwardTV
Revision as of 18:17, 20 June 2007 by Timdorr (talk | contribs) (Pre-requisites)
Jump to: navigation, search
Links to illegal warez, etc. will be removed, and your access will be blocked. (Details)

Apparently, there are some copies of patchstick images in the wild. Most likely, these will not work. Also, THEY ARE ILLEGAL! Also, some people report that the patchstick erased their AppleTV, resulting in a non-recoverable AppleTV. This is actually quite credible, since all Patchstick does is run some shell scripts as root. If this happened to you: GOOD FOR YOU! Moron. Don't count on Apple to help you.

This page describes how to make a Patch stick using OSX/Intel binaries, and therefor is not legally distributable. Therefor, no support whatsoever is given to anyone.

However, I think this process is important enough to document, so we can see what steps are needed to build an open, free and 100% legal version of Patchstick. - Mactijn 23:56, 8 April 2007 (CEST)


  • USB flashdrive or disk (USB mass storage compatible)
  • an Intel machine running MacOSX 10.4.x (I used my macbook) (hblaschka: won't work on non-intel machines, kext files not compatible)
  • boot.efi from your ATV (yes I know, chicken/egg. Work is being done to remove this requirement)

NOTE: If you do not have boot.efi you can extract it from the latest software update

Partitioning and formatting the USB disk

based on Turbo's excellent guide here.

  • hook up the USB drive to your iMac, macbook or macbook pro
  • check what disk it is:
hostname:~ user$ df -h
/dev/disk0s2               74G    72G   1.9G    97%    /
devfs                     100K   100K     0B   100%    /dev
fdesc                     1.0K   1.0K     0B   100%    /dev
<volfs>                   512K   512K     0B   100%    /.vol
automount -nsl [205]        0B     0B     0B   100%    /Network
automount -fstab [219]      0B     0B     0B   100%    /automount/Servers
automount -static [219]     0B     0B     0B   100%    /automount/static
/dev/diskX                499M    40K   499M     0%    /Volumes/NO NAME

NOTE: if you see something like /dev/disk1s1, /dev/diskX means /dev/disk1, not /dev/disk1s1!

  • become root, and unmount the disk
hostname:~ user$ sudo -s
hostname:~ root# diskutil unmountDisk /dev/diskX
Disk /dev/diskX unmounted
  • destroy the current partition table:
hostname:~ root# dd if=/dev/zero of=/dev/diskX bs=1m count=10
10+0 records in
10+0 records out
10485760 bytes transferred in 6.547830 secs (1601410 bytes/sec)
  • create a new one:
hostname:~ root# gpt create /dev/diskX
  • show the layout of the empty table:
hostname:~ root# gpt show /dev/diskX
    start     size  index  contents
        0        1         PMBR
        1        1         Pri GPT header
        2       32         Pri GPT table
       34  1022141         
  1022175       32         Sec GPT table
  1022207        1         Sec GPT header
  • calculate (in any calculator) how many sectors (size above is not in MB, KB or Bytes) you need for the primary partition:
(<size from gpt>/<disk size in megabytes>)*80 = <number of sectors needed to build root partition of 80MB> (often 2048, you may need to round the result)
  • create a new HFS partition, according to the start value given above:
hostname:~ root# gpt add -b 34 -s 163840 -i 1 -t "48465300-0000-11AA-AA11-00306543ECAC" /dev/diskX
  • show the layout of the now half-filled table:
Hostname:~ root# gpt show /dev/diskX
    start     size  index  contents
        0        1         PMBR
        1        1         Pri GPT header
        2       32         Pri GPT table
       34   163840      1  GPT part - 48465300-0000-11AA-AA11-00306543ECAC
   163874   858301        
  1022175       32         Sec GPT table
  1022207        1         Sec GPT header
  • create a secondary partition:
hostname:~ root# gpt add -b 163874 -s 858301 -i 2 -t "48465300-0000-11AA-AA11-00306543ECAC" /dev/diskX
  • Unplug and re-plug your USB disk. OSX will now give a dialog saying that the disk you inserted was not readable by this computer. Click on "Initialize..."
  • Disk utility will open. Select the first partition (diskXs1) on the left. Then, select the "Erase" tab. In the "Name" field, type "Patchstick-root". Click the "Erase" button, and confirm.
  • Do the same for diskXs2, but name it "Patchstick".

Creating the patchstick boot-environment

this part is, for now, based on copying OSX binaries, and needs to be replaced ASAP

After performing the steps in the previous chapter, the USB drive's primary partition should have mounted itself as /Volumes/Patchstick-root. If you named it differently, please substitute all occurences of /Volumes/Patchstick-root with the correct one.

  • in a shell, as root, change the current directory to the patchstick root FS:
hostname:~ root# cd /Volumes/Patchstick-root
  • create the directory structure:
hostname:/Volumes/Patchstick-root root# mkdir -p sbin usr/lib/system System/Library/Extensions stuff etc dev OSBoot
hostname:/Volumes/Patchstick-root root# ln -s sbin bin
  • copy semthex's kernel (named mach_kernel) to /Volumes/Patchstick-root/
  • create /Volumes/Patchstick-root/ with your favourite text editor (vi/pico/joe/...) and make it look like this:
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "">
<plist version="1.0">
        <key>Background Color</key>
        <key>Boot Fail Logo</key>
        <key>Boot Logo</key>
        <key>Kernel Flags</key>
  • copy over the following files: (EDIT: PLEASE see Notes on the bottom about the required .kext stuff, you'll run out of disk space if you don't.)
hostname:/Volumes/Patchstick-root root# cp -R /System/Library/Extensions/* /Volumes/Patchstick-root/System/Library/Extensions/
hostname:/Volumes/Patchstick-root root# cp /bin/bash /bin/chmod /usr/sbin/chown /bin/cp /sbin/mount /sbin/mount_hfs /sbin/mount_devfs /bin/sleep /sbin/umount /bin/sync /Volumes/Patchstick-root/sbin/
hostname:/Volumes/Patchstick-root root# cp /usr/lib/dyld /usr/lib/libSystem.B.dylib /usr/lib/libncurses.5.4.dylib /usr/lib/libgcc_s.1.dylib /Volumes/Patchstick-root/usr/lib/
hostname:/Volumes/Patchstick-root root# cp /usr/lib/system/libmathCommon.A.dylib /Volumes/Patchstick-root/usr/lib/system/
  • Patch the AppleFileSystemDriver and add the following section to the file /Volumes/Patchstick-root/System/Library/Extensions/AppleFileSystemDriver.kext/Contents/Info.plist in the IOPropertyMatch array:
                                                <key>Content Hint</key>
                                                <key>Content Hint</key>
                                                <key>Content Hint</key>

  • now, create /Volumes/Patchstick-root/sbin/launchd with your favourite text editor (vi/pico/joe/...) and make it look like this:

exec 2>/dev/console
exec 1>/dev/console

echo "        --- AppleTV Patchstick ---"
echo '        (please ignore the "invalid destination port\" errors)'

# echo "        * remounting / r/w"
# /sbin/mount -uw /

echo "        * mounting OSBoot partition r/o"
/sbin/mount -t hfs -r /dev/disk0s3 /OSBoot

echo "        * re-mounting OSBoot partition r/w"
/sbin/mount -uw /OSBoot

echo "        * mounting stuff partition r/o"
/sbin/mount -t hfs -r /dev/disk1s2 /stuff

if [ -d /OSBoot/dev/ ]; then

  for i in /stuff/installer.d/*; do
    echo "        --- ${i} ---"
    /sbin/bash "${i}"

  /sbin/sync &>/dev/null
  /sbin/umount /OSBoot
  echo "        all done!"

  echo "        ! OSBoot not mounted, not installing or modifying anything"

echo "        Now, you can reboot your AppleTV by unplugging/replugging the power supply."
/sbin/sleep 100000
  • make our launchd replacement executable:
hostname:/Volumes/Patchstick-root root# chmod 755 /Volumes/Patchstick-root/sbin/launchd
  • add AppleTV's own boot.efi to the root of the patch stick.
cp /Volumes/OSBoot/System/Library/CoreServices/boot.efi /Volumes/Patchstick-root/

Adding patches

Patching just got a bit more modular. First, we have to create the scripts dir:

hostname:~ root# mkdir /Volumes/Patchstick/installer.d/


To add SSH, do the following:

  • make the SSH directory:
hostname:~ root# mkdir /Volumes/Patchstick/ssh
  • create /Volumes/Patchstick/ssh/ssh.plist, make it look like this:
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "">
<plist version="1.0">
  • copy the sshd binary to the patchstick:
hostname:~ root# cp /usr/sbin/sshd /Volumes/Patchstick/ssh/sshd
  • add an installer script to /Volumes/Patchstick/installer.d/, name it 'ssh':

# install ssh
# (c) 2007 macTijn at awkwardtv dot org

if [ -f /stuff/ssh/sshd ] && [ -f /stuff/ssh/ssh.plist ]; then
  echo -n "        * installing SSH daemon... "
  cp /stuff/ssh/sshd /OSBoot/usr/sbin/sshd
  cp /stuff/ssh/ssh.plist /OSBoot/System/Library/LaunchDaemons/ssh.plist
  echo "done."
  echo "        Needed SSH files not found, not installing"

Adding Perian

  • download and mount the current Perian .dmg
  • make a directory:
mkdir /Volumes/Patchstick/perian/
  • copy Perian.component from the .dmg to /Volumes/Patchstick/perian:
hostname:~ root# cp -R Perian.component /Volumes/Patchstick/perian/
  • add an installer script to the installer.d directory, name it 'perian':

# Perian installer script
# (c) 2007 macTijn at awkwardtv dot org

if [ -d /stuff/perian/Perian.component/ ]; then
  echo -n "        * installing Perian Quicktime codec set... "
  cp -R /stuff/perian/Perian.component /OSBoot/Library/Quicktime/
  echo "done."
  echo "        Perian files not found."

All done! your patchstick should be completely done by now.

The aftermath

Updating the Patchstick-root partition UUID

The AppleTV will only boot from a disk partition that has an AppleTV recovery UUID. There's no way to modify the UUID of a partition so you'll need to delete the boot partition (just the partition definition, not the partition data) and create another with the correct UUID in the same location. When you create the new partition, pass gpt the same -b and -s parameters that you used to create the patition you're replacing.

  • unmount the partitions:
hostname:/Volumes root# diskutil unmountDisk /dev/diskX
 Disk /dev/diskX unmounted
  • remove the Patchstick-root partition...
hostname:/Volumes root# gpt remove -i 1 /dev/diskX
gpt remove: /dev/diskX: 1 partition(s) removed
  • Every time the partition table is updated MacOS will remount all valid partitions on the device. You'll need to unmount them before gpt will allow you to modify the partition table again.
  • unmount all partitions:
hostname:/Volumes root# diskutil unmountDisk /dev/diskX
 Disk /dev/diskX unmounted
  • Change the Patchstick-root partition to an AppleTV recovery partition
hostname:/Volumes root# gpt add -b 34 -s 163840 -i 1 -t "5265636F-7665-11AA-AA11-00306543ECAC" /dev/diskX
  • unmount the partitions again.
hostname:/Volumes root# diskutil unmountDisk /dev/diskX
 Disk /dev/diskX unmounted
  • Disconnect your patchstick.


  • Q: I'm getting 'Invalid destination port' errors all over my screen!
    • A: Yeah, I know. Ignore them. But only those!
  • Q: I'm getting "master.passwd: file not found" errors!
    • A: please re-mount your Patchstick-root volume to /Volumes/Patchstick-root, and type:
grep '^root:' /etc/master.passwd > /Volumes/Patchstick-root/etc/master.passwd
  • Q: My patchstick keeps telling me it's "Waiting for root device". What did I do wrong?
    • A: You probably forgot the step where you have to alter the plist file in the AppleFileSystemDriver kext. Please try again.


  • [page] credits!
  • [page] add links to various items (semthex's kernel, Perian, ATVFiles)
  • [page] add more FAQ's (and their answers)
  • [procedure] kill off unneeded kext stuff, takes too much space like this
  • [script] add more optional hacks
  • [script] hide patch messages, instead make animated (a la factory restore animation)


  • The installer gives a lot of "bootstrap_look_up() failed (ipc/send) invalid destination port" errors. Ignoring them is safe. This is something launchd/mach_init specific which we cannot implement in a bash script.
  • Sometimes the mounts go wrong. This means the journal on the filesystem it is trying to mount is dirty. Just reboot to the regular ATV OS, and retry.
  • after booting to safe mode once, you don't need to do the menu & - trick again. Just plug in the USB drive, reboot by unplugging/replugging the power. Works fine here. - Mactijn 11:36, 14 April 2007 (CEST)

I used the above list to copy the kext to the USB stick and the only one missing kext to boot was:


Still a few error messages but it worked.

To copy all these including AppleIntelCPUPowerManagement.kext, in one command use:

cp -R /System/Library/Extensions/{AppleACPIPlatform,AppleAPIC,AppleEFIRuntime,AppleFileSystemDriver,AppleFlashNVRAM,AppleHDA,AppleHPET,AppleIRController,AppleRTC,AppleSMBIOS,AppleSMC,AudioIPCDriver,BootCache,GeForce,IO80211Family,IOACPIFamily,IOATAFamily,IOAudioFamily,IOGraphicsFamily,IOHIDFamily,IONDRVSupport,IONetworkingFamily,IOPCIFamily,IOPlatformPluginFamily,IOSCSIArchitectureModelFamily,IOStorageFamily,IOUSBFamily,IOUSBMassStorageClass,NVDANV40Hal,NVDAResman,OSvKernDSPLib,System,AppleIntelCPUPowerManagement}.kext /Volumes/Patchstick-root/System/Library/Extensions/