Introduction

During power-on boot, AppleTV EFI firmware finds and executes the file "boot.efi" on a "Recovery" or "OSBoot" partition. This "boot.efi" file is responsible for loading the mach kernel and kexc drivers using "com.apple.Boot.plist". It must be an original AppleTV "boot.efi"and not one from an Intel Mac as it is signed and efi firmware checks the certificate and will rejected a "bad" "boot.efi" file. So for atv-bootlaoder to work, you need a copy of "boot.efi". This raises the chicken-or-egg question of how do you get "boot.efi" without opening the AppleTV and removing the hard drive. If you have already enabled "ssh" using a "patchstick" you can just extract it directly from your AppleTV using "scp" using something like this

scp frontrow@YOUR.IP.ADDRESS.HERE:/System/Library/CoreServices/boot.efi ./

If you don't have ssh enabled and don't want to open up the AppleTV, the solution is simple, extract it from the AppleTV update. The following instructions detail how to download the AppleTV 2.0.2 update and extract "boot.efi" using "dmg2img". "boot.efi" is the only file required to enable atv-bootloader to boot linux so unless you are interested in building a patchstick, you can delete the downloaded/converted files.

This needs to be done using an installed/working Linux distro and not a LiveCD. Some LiveCD distros use unionfs and loopfs does not work under a unionfs mount.

Update - April 29, 2008 - Apple seems to have purged their previous updates. The following are now missing from mesu.apple.com.

1.0.1 - at http://mesu.apple.com/data/OS/061-2988.20070620.bHy75/2Z694-5248-45.dmg 
2.0.0 - at http://mesu.apple.com/data/OS/061-3561.20080212.ScoH6/2Z694-5274-109.dmg
2.0.1 - at http://mesu.apple.com/data/OS/061-4375.20080328.gt5er/2Z694-5387-25.dmg

Still present is the current 2.0.2 update.

2.0.2 - at http://mesu.apple.com/data/OS/061-4632.2080414.gt5rW/2Z694-5428-3.dmg

Details

download the update and extract boot.efi

# install some required tools to build dmg2img
#
sudo apt-get install build-essential zlib1g-dev

# download and built dmg2img
wget http://atv-bootloader.googlecode.com/files/atv-dmg2img-1.0.tar.gz
tar -xzf atv-dmg2img-1.0.tar.gz
cd dmg2img
sudo ./install_dmg2img.sh

# download the AppleTV 2.2 update
wget http://mesu.apple.com/data/OS/061-4632.2080414.gt5rW/2Z694-5428-3.dmg
#
# convert it to an img format
dmg2img 2Z694-5428-3.dmg atv.img

# create a mount point
mkdir atv-update

# mount the converted img
sudo mount -o loop -t hfsplus atv.img atv-update

# extract boot.efi
sudo cp -ap atv-update/System/Library/CoreServices/boot.efi ./

# check that boot.efi byte count is the same.
# the time stamp might be different and that does not matter
# It is the permissions and byte count that are important.
ls -l boot.efi
# Mine reports "-rw-r--r-- 1 root    root       298800 2007-06-19 00:47 boot.efi"

# and the md5 checksum should match below.
md5sum boot.efi
280323d8700e4cfef15116f7e50590e3  boot.efi

cleanup (if you are not building a patchstick)

sudo umount atv-update
rmdir atv-update
rm atv.img
rm 2Z694-5428-3.dmg

Comment by sonny.benshimon, Apr 30, 2008

On the second paragraph I think you meant AppleTV2.2 and not AppleTV2.1

Comment by sdavilla, Apr 30, 2008

Fixed. It's really 2.0.2 following Apples version numbers. I've also fixed the other pages that reference 1.x and 2.x.

Comment by ricksaiz, May 25, 2008

Everything ok except when I do the cp:

sudo cp -ap atv-update/System/Library/CoreServices?/boot.efi ./

I get an input/output error message and the destination boot.efi with zero bytes.

I can copy some other files, but cant boot.efi

Comment by sdavilla, May 25, 2008

need more info.

"ls -l atv-update/System/Library/CoreServices?/boot.efi"

and exact error message.

Comment by ricksaiz, May 25, 2008

Reinstalled ubuntu 8.04, (I used 7.01) did everything again and now it worked. I don't know why, but I feel that the converted img file had some weird conversion error.

Comment by tiago.henriques, Jun 18, 2008

On OS X just download the AppleTV 2.2 update and double click the dmg to mount it. You can then find the file boot.efi under /Volumes/OSBoot/System/Library/CoreServices?

Comment by j...@llnw.com, Sep 18, 2008

This needs to be done using an installed/working Linux distro and not a LiveCD. Some LiveCD distros use unionfs and loopfs does not work under a unionfs mount.

You can get around mounting-loop-under-unionfs/aufs-rootfs issues by moving the update.dmg file to a tmpfs and unpacking from there. Most livecd's have a tmpfs auto-created for /tmp.

This requires a lot of RAM though and you may have to manually resize the tmpfs: "mount -t tmpfs -o remount,size=1G tmpfs /tmp"

Comment by sean.rhodes, May 15, 2009

Scott,

I'm using ubuntu 8.10 and I cannot convert any dmg file. I noticed all the following warnings, but no errors during the compile. It did not compile correctly, since I get command not found when I try to run it.

Extracting dmg2img source and patching patching file dmg2img.c Build/Install dmg2img rm -f dmg2img ~ .o gcc -O3 -c dmg2img.c dmg2img.c: In function ‘main’: dmg2img.c:130: warning: format ‘%u’ expects type ‘unsigned int’, but argument 3 has type ‘long unsigned int’ dmg2img.c:114: warning: ignoring return value of ‘fread’, declared with attribute warn_unused_result dmg2img.c:117: warning: ignoring return value of ‘fread’, declared with attribute warn_unused_result dmg2img.c:120: warning: ignoring return value of ‘fread’, declared with attribute warn_unused_result dmg2img.c:140: warning: ignoring return value of ‘fread’, declared with attribute warn_unused_result dmg2img.c:213: warning: ignoring return value of ‘fread’, declared with attribute warn_unused_result dmg2img.c:229: warning: ignoring return value of ‘fwrite’, declared with attribute warn_unused_result dmg2img.c:239: warning: ignoring return value of ‘fread’, declared with attribute warn_unused_result dmg2img.c:242: warning: ignoring return value of ‘fwrite’, declared with attribute warn_unused_result dmg2img.c:250: warning: ignoring return value of ‘fwrite’, declared with attribute warn_unused_result gcc -O3 -c base64.c gcc -o dmg2img dmg2img.o base64.o -L. -lz install -m 755 -o root -g root dmg2img /usr/bin Done -- cleaning up

Comment by sean.rhodes, May 15, 2009

I tried re-compiling and got the same errors, but it appears to have created the file in my /usr/bin directory as v0.3a. However when I try to convert a file it gives me an error:

sean@sean-desktop:~$ dmg2img recovery.dmg test.img

dmg2img v0.3a is derived from dmg2iso by vu1tur (to@vu1tur.eu.org)

recovery.dmg --> test.img

reading property list, 0 bytes from address 0 ... ERROR: Property list is corrupted.

Comment by bdoggy, Nov 01, 2009

for those of us still doing it the old fashioned way, the current ATV firmware is http://mesu.apple.com/data/OS/061-6242.20090624.Aq20P/2Z694-5660-029.dmg . The others have disappeared from the net.