Apple TV OS 10.4.7

From AwkwardTV
Jump to: navigation, search


Build version and kernel

This is the operating system that is driving the Apple TV out of the box:

System Version: Apple TV OS 10.4.7 (8N5107)
Kernel Version: Darwin 8.8.2
Boot Volume: OSBoot
Computer Name: AppleTV

This is the uname -a output:

appletv.home 8.8.2 Darwin Kernel Version 8.8.2: Mon Jan 29 18:57:29 PST 2007; root:xnu-792.94.18~1/RELEASE_I386 i386 i386


This is a "kernel cache" file created by the -c option of kextcache(8). It contains a mach_kernel bundled with a pre-linked set of kernel extensions. kextcache compresses the kernel cache using the LZSS algorithm and prepends a custom 384-byte (180 hexadecimal) file header to the compressed data, producing the following file format:

Kernel Cache Format
Offset Field Type Description
0 signature uint32_t 'comp' = compressed file
4 compress_type uint32_t 'lzss' = compressed with LZSS algorithm
8 adler32 uint32_t Adler-32] checksum of uncompressed payload
12 uncompressed_size uint32_t payload size, uncompressed
16 compressed_size uint32_t payload size, compressed
20 reserved 44 bytes reserved for future definition
64 platform_name char[64] UTF-8 string containing the name of the root entry of the IOService plane
128 root_path char[256] value of device tree node /chosen/rootpath or a concatenation of /chosen/boot-device-path and /chosen/boot-file
384 data compressed data payload containing a kernel in Mach-O(5) format with pre-linked extensions in the __text, __symtab, and __info sections of the __PRELINK segment.


  • Integer fields use big-endian byte order.
  • If the first byte of platform_name or root_path is 0, then both bytes are set to 0 (this is the case for the Apple TV kernel cache). In other words, if platform_name contains an empty string, then root_path is not used.

Creating Your Own Kernel Cache

Here is an example of how to create a kernel prelink with your own kernel and extensions [1]:

kextcache -v 5 -a i386 -s -K ~/mach_kernel.semthex -c /tmp/mach_kernel.prelink /System/Library/Extensions

This assumes that your kernel is in your home directory and named mach_kernel.semthex, and that your extensions are in /System/Library/Extensions. The new mach_kernel.prelink file will be located in /tmp, place it appropriately.


/System/Library/CoreServices/ does not contain the real Finder, but the Apple TV GUI. This is a custom application not available on Macintoshes.

Enable real Finder

It is not (easily) possible to enable the real Finder since it is not there and it would require SSE3, which the Apple TV doesn't have. Also, Watchdog must be taken care of.


See the full file list of a virgin Apple TV here.

Apple binary-protected files

The Apple TV runs Apple binary-protected files:

  • (which is not the real Finder, but the Apple TV frontend)
  • AppleTCOWatchdog.kext
otool -l /System/Library/CoreServices/
Load command 0
      cmd LC_SEGMENT
  cmdsize 56
  segname __PAGEZERO
   vmaddr 0x00000000
   vmsize 0x00001000
  fileoff 0
 filesize 0
  maxprot 0x00000000
 initprot 0x00000000
   nsects 0
    flags 0x4
Load command 1
      cmd LC_SEGMENT
  cmdsize 532
  segname __TEXT
   vmaddr 0x00001000
   vmsize 0x00050000
  fileoff 0
 filesize 327680
 maxprot 0x00000007
 initprot 0x00000005
   nsects 7
    flags 0x8

Heres the combo update for 10.4.7, might be useful for files for ATV if you have since updated your computer to 10.4.9