Posted on 57 Comments

*UPDATED* Jailbreak Apple TV 2nd Gen – 4.4.4 9A406a iOS 5.0.1

UPDATE 4/2/12 – If you have updated to AppleTV 5.0, there is now a jailbreak method and XBMC available. Check this post for updated info and downloads for version 5.0 (9B179b iOS 5.1).
Today, I successfully jailbroke and installed XBMC tonight on a Apple TV 2 I purchased 3 hours ago. Finding an Apple TV 2 in-stock was a chore in itself as the Apple TV 3 was just released. I’m watching my network shares on XBMC as I write this.

Most methods written in the last few weeks and days didn’t work for me and tons of other commenters all over the web because of Apple no longer signing firmwares from their website. This means that iTunes no longer recognizes 4.4.4 as official. When it checks legitimacy of firmwares, it will reject ones created without the signed unit unique SHSH blobs embedded.

NOTE 1: From everything I’ve read, you need to make sure you have firmware 4.4.4 and not 5.0. If you let iTunes upgrade you to 5.0, there is no current jailbreak or downgrade to 4.4.4 without SHSH blobs. You need the SHSH Blobs to sign custom firmwares (like the jailbreak hack below); otherwise, iTunes will not restore this custom firmware. SHSH Blobs are specific to only your device.

NOTE 2: You must use Windows for this method to work!

NOTE 3: You need a micro USB to standard USB cable. Almost all Android devices have these as part of their chargers and this is what I used.

How to Jailbreak Apple TV 2nd Gen as of 3/17/12

I will rewrite the original instructions because they were a little vague to me. Credit goes to user CYBERxNUKE on I highly recommend reading the original instructions and watching the video multiple times before you try this method.

Watch this video and pause frequently as you go through the steps:

Step 1 – Download Software

I recommend putting all the following downloads into a new folder on the desktop to stay organized. Download the following software as you’ll need it later (remember, this is Windows only!):
seas0npass – newer versions won’t work. You need version! (I believe CYBERxNUKE accidentally wrote
iFaith – from
Total Commander – this is used to open and edit container files (you’ll see later)
iTunes 10.5+ – you need at least iTunes 10.5. I didn’t have it, so I downloaded a fresh copy of 10.6

Step 2 – Get Your SHSH Blobs with iFaith

If you found this page, you’ve probably come across TinyUmbrella. This does not work for this tutorial! You need to open iFaith and press OK a few times. When you get to the iFaith homescreen, choose “Dump SHSH Blobs”. This will a “.ifaith” file up to your Documents folder.

After you press the “Dump SHSH Blobs”, keep advancing: “Proceed > Let’s Go > Yes”

At this point, you should see an animation showing you to ONLY plug in your micro USB cable. Once Windows recognizes and installs drivers if necessary, press “Start”. When the FIRST counter gets to “2” press and hold the “Play” + “Menu” until the second counter counts down from “5” (that’s a total of 7 seconds). This trick puts you into DFU mode. When you release, iFaith will go through a series of steps and download the SHSH Blobs. If it doesn’t work the first time, keep trying to get your timing down.

After this step finishes, unplug your Apple TV from the computer!

Step 3 – Build *signed* IPSW w/ Blobs

This step will integrate the necessary authentication files inside a standard Apple TV restore file (.IPSW) so that iTunes will later accept your final jailbreak .ISPW file.

Go back to the homepage of iFaith and choose “Build *signed* IPSW w/ Blobs”. Click “Browse for SHSH Blobs cache” and navigate to your Documents folder. Open the file that ends with .ifaith that was just created. It will have a really long name starting with numbers. You should keep a copy of this file in a secure location forever. It is specific to just your Apple TV.

After you’ve selected your .ifaith file, you will be asked to browse for the 4.4.4 (9A406a) IPSW file. Choose “Download it for me”. (If for whatever reason that fails, you can try to get it from apple or iClarified). After it downloads, iFaith will sign your standard IPSW file with your SHSH Blobs.

Once you iFaith has created your signed 4.4.4 IPSW file, move it to your new folder on the desktop so its easier to find. This file will be about 395MB and have a really long name that ends in “…signed.ipsw”.

Step 4 – Seas0nPass IPSW Restore Creation

This step will create the necessary files in a IPSW to jailbreak your Apple TV. We will extract these later and merge them with our signed IPSW we created in Step 3. Starting to see how this comes together?

Start Seas0nPass. Remember: this must be version since newer versions won’t work. If you’re unsure if you have the right file (its linked above in the download section), hover your mouse over the program icon and you’ll see the version info.

When Seas0nPass is started, just press “Create IPSW”. This is going to take about 10 minutes, so go play Solitaire. Seas0nPass is going to download the firmware 4.4.4 IPSW and then inject the jailbroken payloads.

After the process completes you should move the folder “Seas0nPass” from “Documents” to your new folder you created on the desktop.

Step 5 – Extract Jailbreak Payload from Seas0nPass IPSW

These next few steps can be confusing, so pay close attention to file names!

Drag the file “AppleTV2.1_4.4.4_9A406a_SP_Restore.ipsw” over the Total Commander shortcut on the desktop. This will cause Total Commander to open the .ipsw file and you can see its contents in the left panel.

If this is your first time running Total Commander, there will be the occasional window that pops up asking you confirm settings. The defaults are ok.

After you have “AppleTV2.1_4.4.4_9A406a_SP_Restore.ipsw” open in Total Commander, select the 2 files in the left panel called using your SHIFT key:
– 038-3845-002.dmg
– 038-3848-002.dmg

Drag these 2 files over to the right panel so they extract to the hard drive. You may have to give admin rights if prompted.

Step 6 – Inject and Overwrite With Jailbroken Files in *signed* ISPW

This next step involved taking the extracted .dmg files from Step 5 and overwriting those in the *signed* IPSW file created by iFaith.

Drag your IPSW file created in Step 3 that ends in “…signed.ipsw” over the Total Commander shortcut so that it opens in Total Commander. Select your 2 .dmg files you extracted in Step 5 and replace those in “…signed.ipsw”. Make sure to choose “Overwrite all” when prompted.

Step 7 – Put Apple TV in DFU Mode to Receive Jailbroken Signed IPSW

You are now ready to put the Apple TV 2 in DFU mode to accept the jailbroken and signed IPSW restore file.

Go to the homescreen of iFaith again. Select “Use DFU Pwner (iREB)” and follow the onscreen instructions. Connect the Apple TV 2 to your computer with just the USB cable. Don’t forget to hold Play+Menu for 7 seconds.

Step 8 – Restore the Jailbroken Signed IPSW Through iTunes

Start iTunes. It may ask you to connect to Apple to check the version of your Apple TV. This is ok as long as you don’t try to get updates from Apple (the dreaded 5.0).

IMPORTANT: Press and hold the SHIFT key while clicking “Restore” in iTunes on your Apple TV. If you don’t press and hold SHIFT while left-clicking, you could accidentally upgrade! Browse for your IPSW file ending in “…signed.ipsw”. If you don’t pick the signed IPSW file that iFaith first created you’ll get a 3194 error (“This device is not eligible for the requested build”).

Almost Done – Just Install XBMC

The hard part is over. If iTunes told you the restore was successful, you just need to follow the steps in the following video. To SSH in and install XBMC, Mac users need to go to Applications > Utilities > Terminal, and Windows users will need Putty.
The video starts half-way through because the 1st half is a broken method for jailbreaking Apple TV 2, but the XBMC bit is still valid (thanks ifibashir):

Credits: CYBERxNUKE, firecore, ih8sn0w, and ifibashir

57 thoughts on “*UPDATED* Jailbreak Apple TV 2nd Gen – 4.4.4 9A406a iOS 5.0.1

  1. where is credits to people who made this ?

    1. see the bottom of the post and throughout the post…

      1.  HELP stuck on error 1600. followed post above but still stuck on error1600….please HELP

        1.  me too, help please

          1.  me too

          2.  just got past iFaith error by reinserting cable and a quick hold of menu+play buttons

        2. see my reply above to Nick. sounds like you’re not going into DFU mode as described in Step 7

          1. Hi spoonjab, I get in the proper DFU mode with the exploit being patched, but while restoring with the custom IPSW it gives me a 1600 error too

          2. Same. I am in DFU but cannot get past 1600 in iTunes

          3. My season pass is crashing 

  2. Good job man, props. Worked like a charm

    1. I need help on my 4.4.3 (3323) os 5.0.1 (9a405i). I just bought this. Can anyone tell me how to jailbreak step by step and what thing I need to downloaded on window. I am new in to apple tv. Please step by step. I try few things. Error popping.. This apple tv is not eligible for this version. .. Please email if you can..
      Thank you

      Can I watch movies for free? Or just sports ?

      1. dude, can u read?
        nobody will answer 2 your post.

  3. I’ve tried this 3 times now but iTunes will not complete the restore and get an ‘unknown error (1600)’. Any help would be appreciated

    1. based on this website ( ), it seems you didn’t follow Step 7 to get DFU mode properly? Try “Use DFU Pwner (iREB)” in iFaith. just a guess.

      1. I tried using iFaith a second time but now iFaith reads a popup with “A DEVICE OTHER THAN THE Apple TV 2 WAS DETECTED! ABORTING…” and the application quits

        1. I saw this a few times. Just restart the application and make sure seas0npass isn’t still running.

  4. i have version 4.4.3 on my atv2…..get down to the last step of restoring on itunes and i get “error code 2005”. any idea what this is? i’m sure i followed all instructions to the letter and watched that video a lot…..

    1. try different USB port or cable?

    2. I also have 4.4.3 (9A405l). When I run Seas0nPass. and click Create IPSW it just wants to use 4.4.4 – I can see this will be an issue. Any ideas?

      1.  I worked it out. Just hold down shift when you click Create IPSW, then select the AppleTV2,1_4.4.3_9A405l_Restore.ipsw file.

  5. the issue i’m having starts when i try to run seas0npass… starts running then shortly after a error message pops up that says:

    “xpwntool.exe – application error

    the application failed to inatialize properly (0xc0150002). click ok to terminate the application”

    1. I’m having a similar issue but in iFaith, when I click “Build IPSW.” Just when iFaith indicates it is “Processing RAMDisk,” It see the xpawntool.exe error message and iFaith crashes.

  6. Thank you for clear instructions, however I have problem w/ step#3. i am unable to download file that ends  “…..signed.ipsw” instead of that I download all time AppleTV2,1_4.4.4_9A406a_Restore.ipsw file, which I’m trying to restore my apple tv in step#8. I tried 3 time and I get all the time error  3194  🙁
    Why is that? 
    looks like iFaith doesnt create ‘…..signed.ipsw” file.

    Thank you for your help

    1. sorry. i re-read the instructions and the last paragraph in Step 3 was unclear. I’ve re-written it. You are not downloading the IPSW that is signed. You are downloading a fresh copy of 4.4.4 and then iFaith is creating a new IPSW that ends with “…signed.ipsw” after it signs the file with your SHSH blobs. make more sense?

      1.  Excellent job!!!
        Made it!!!
        Thanks spoonjab

  7. Awsome tutorial. Works like a charm! 🙂

  8. Finally, got past the dreaded 3194, your tut was terrific! many many thanks, I would like to add one thing for folks who may have missed it. After you load the ssh file and then download or search for your .ipsw file you must click build on the bottom right hand side of the ifaith screen to complete the creation of the signed.ipsw file. Again many thanks Stylie

  9. I was trying to JB my ATV2 but now just realized that it is on version 4.4 not 4.4.4. Is there a way to make this work for 4.4 version? Or better yet how can I upgrade to 4.4.4?

    BTW, was having a hard time getting into DFU mode, tried for 5 long days, only to try a different micro USB cable and voala!

  10. It worked for me; however, to get past the initial error in iFaith I reinstalled .NET 3 and that seemed to solve the problem. Also, I didn’t know .NET 4 is required for SeasOnPass. I installed that, kept calm and carried on. No errors when I restored through iTunes. And I did all that with 4.1.1 (4.2.1 ipsw). Ran everything with WinXP-SP3.

    There are a few spots in your instructions that leave out information that’s in the original posting on which you based your version. I kept a posting from the FireCore forum for reference.

  11. You are a LEGEND !

  12. I’m having some issues right from the beginning of this process. Trying to dump my shsh blobs and from step 2, “Load iFaith” and the program just continues to say Waiting for Apple tv 2G…. Is it not going into DFU mode or what?? Please help!

    1. Same prob u have a solution??

  13. works perfect just jailbroke and installed xbmc
    thanks for the tut

    1. If I give you my apple TV 2 ecid would you download my blobs via I faith and creat the proper signed Ipsw file and upload it to rapid share or some other file sharing site? If your will email me at


  14. Hi. I’m having trouble getting past the 1600 error. At first I was getting the error immediately after I did shift +restore in iTunes. I solved this by:
    – holding down the Menu + Down arrow for 7 seconds until reboot
    – then holding Menu + Play/Pause for 5 seconds
    – THEN running iFaith DFU pwner (this was the only way I could get into a true DFU, not iReb or anything else.)
    Now I can get past the initial 1600 error, and iTunes appears to accept the jailbreak and verify the restore, then BAM, another 1600 error right as the firmware is about the reload.
     It seems that the ATV2 disconnects then connects to the computer during the last step, and I that’s when I lose my DFU mode and again get the 1600 error. I count a total of 4 connects + disconnects during the whole jailbreak, based on the noise my windoze laptop makes. I get the error right after the 4th connect.
     I’m running:
    Windows 7
    ATV2 4.4.4
    SeasonPass with modified + signed IPSW from iFaith and Total Commander.
    Any help would be huge. I’m losing my mind trying to restore this POS and now im stuck in DFU loop which I cannot get out of. My only options are to either jailbreak or restore to updated firmware and lose my ability to jailbreak. I refuse to lose!!

    1. Anyone else getting iTunes 1600 error during the final step?

      1. Yeah I managed to jailbreak 2 ATV’s. Then a few days later when I tried it again with a third I keep getting error 1600

      2. Yep!

    2.  hey there Nick, did you get anywhere with this 1600 error?
      Im getting this as well, looked everywhere and tried a bunch of different things…still no luck
      I have 15 ATV 2s to jailbreak, and only my first one was successful!

  15.  Ok I need some serious help. I have spent days reading this thread and
    watching videos and the more I watch and read the more confused I get.
    Is there anyone who can really talk me through this step by step? I have
    tried to follow these instructions and when I go to restore in itunes
    it tells me the firmware file is corrupt. The video goes too fast and I
    don’t understand it. Would someone be willing to call or IM and help me
    through this. Or somehow sign into my computer and help me. Also the
    Apple TV I have is version 4.4.2 and I don’t know how to get it to 4.4.4
    or if it matters. Please please help.

  16. For those who are having difficulties, just follow the steps very carefully. The process should work for you. Remember, you must have software version 4.4.4 or less on your ATV2. If you have 4.4.3 or 4.4.2 or whatever, don’t bother trying to upgrade; simply download the appropriate *_Restore.ipsw from iClarified or select “Download it for me” at the end of Step 3. Also, in Step 4, be sure to right click Create IPSW in SeasOnPass and select the software version that matches whatever is on your ATV.

  17. I followed everything at least dozen times to the letter. It writes and when it gets to last step and verifying restore i get 1600 error at very end. 

    I am wondering if maybe the device is on 4.4.3 but only saved 4.4.4 shsh due to the time it was jailbroken?

    I have blobs for 4.4.4 on file with cydia. when i try to dump shsh blobs i get error at logo and the process stops. any ideals?

    1. Try a different USB cable and if you are using a laptop, make sure it is connected to the wall outlet (electric power),  

  18. Will this work for 4.3(8f455). I also get the 3194 error and want to try this. How do I go about doing it?

  19.  Excellent write up – my additon:

    My USB ports were not powering the atv2, so I had to plug in my atv2 to the wall right before I needed to plug into the PC.

    Works as of 3/31

    1.  scratch that, 1600 error

      1.  any luck with the 1600 error?
        i am getting this as well!!!

  20. When using iFaith v1.4.2 to dump shsh blobs from ATV2 version 5 I am getting error getting a device other than the apple tv 2 was detected when using iFaith. Anyone getting this and if so is there a solution for this.

    1. If you have version 5 running (not 4.4.4 or lower), you need to visit the following post for the jailbreak:

      1. I followed your link. I created the ISPW using the instructions that you have on the site. I am using Windows XP as my O.S. Then I plugged in my ATV V5 in with the micro usb and counld not get into DFU mode. When I plugged in the power cord I was able to. iTunes opened up and then I hit the shift restore and chose the correct restore and got this message: The Apple TV “AppleTV” could not be restored because the firmware is not compatible. I checked my version of the ATV when I hooked it up to my TV through the HDMI cable and went into the settings  and it says version 5. Really need help not sure what I am doing wrong.

  21. When using iFaith v1.4.2 to dump shsh blobs from ATV2 version 5 I am getting error get a device other than the apple tv 2 was detected ABORTING when using iFaith. Anyone getting this and if so is there a solution for this.

  22. You can now share your issues, ask questions, and post your success stories in the new support forums on Spoonjab.

  23. Followed this to the T twice.  iTunes said it was restored.  Running v4.3.

    I can’t ssh into the box.  Ping verifies connection to the ip listed in menu, but port 22 connection refused

    Please help

  24. Where do you find the “signed.ipsw” file? I can only find the “restore.ipsw” file.

  25. I LOVE YOU!! you made my day. I was so stuck how to use my iFaith blobs with Seas0nPass. you rock!!

  26. Stuck on step 6 guys!!! dmg files on the hard drive (those moved in step 5) are different than those on signed ipsw (different names ad sizes) !!! What should I do? nothing to overwrite!!! THX for your help

Leave a Reply

Your email address will not be published. Required fields are marked *