This page contains the original details on how the USB patch works, and how it was accomplished.
I will also include some additional patches here for disabling the watchdog, and maybe some other stuff
If you don't care how it works, go back to the main page and just apply the USB easy patch.
If you find this information useful, please help develop future enhancements by donating here, or at least clicking on one of the ads.
USB success! (2007-03-29 15:21)
Purpose: Use USB devices with your AppleTV
Notes: Apple's USB device whitelist has been bypassed, and I can confirm a working keyboard that doesn't appear to interfere with the IR remote
A USB storage device is now detected, but no device node is created. IOUSBMassStorageClass.kext is missing
Make the following changes to the uncompressed mach_kernel binary (offsets are file offsets with header removed):
- Change bytes 75 34 (offsets 51f55e 52023e) to 75 30 (adjust jump target by 4 bytes)
51f550: 90 fc 04 00 00 89 c3 66 3b 35 60 5b 6a 00 75 34
520230: 90 fc 04 00 00 89 c3 66 3b 35 60 5b 6a 00 75 34
- Change bytes 75 1c (offsets 51f576 520256) to 75 18 (adjust jump target by 4 bytes)
51f570: 6a 00 21 d0 39 c1 75 1c 0f b7 05 68 5b 6a 00 89
520250: 6a 00 21 d0 39 c1 75 1c 0f b7 05 68 5b 6a 00 89
MD5 for a successfully patched file
(mach_kernel.prelink) = c71420b6a021e15e0b6beadf9eab2ba8
Decompress, patch data, patch header, and reassemble mach_kernel.prelink as outlined below
Thanks go to oz_paulb for a proper disassembly.
Patch mach_kernel.prelink (2007-03-29 12:43)
Purpose: Make changes to the original mach_kernel.prelink file on the AppleTV
Notes: This procedure is how I did it originally. Thanks go to Paul (oz_paulb) for a utility to make this easy.
- Split mach_kernel.prelink into header and data
dd if=mach_kernel.prelink of=mach_kernel.header bs=384 count=1
dd if=mach_kernel.prelink of=mach_kernel.lzssdata bs=384 skip=1
- Decompress mach_kernel.lzssdata using decompress_lzss (using Apple's code)
- Perform binary patches
- Compress the patched binary with compress_lzss (Apple's code)
- Patch mach_kernel.header with the updated information (compressed size, adler32) for the patched kernel
- Rebuild the complete mach_kernel.prelink
cat mach_kernel.header mach_kernel.lzsspatched > mach_kernel.prelink
- Upload new mach_kernel.prelink and reboot
AppleTV will first try to boot mach_kernel.prelink from disk0s2 (Recovery). If this fails, it will try mach_kernel.prelink on disk0s3 (/).
If both fail to boot the machine, it will loop.
Modified 2007-04-07 11:52:33
Contact turbo here