How to Jailbreak Your Apple TV Using LiberTV 1.1 (Mac) [tvOS 11.0 - 11.1]

These are instructions on how to jailbreak your Apple TV running tvOS using liberTV 1.1.

This jailbreak currently supports any fourth generation Apple TV or Apple TV 4K running tvOS 11.0 to 11.1.

Step One
Download the latest liberTV jailbreak IPA from here and Cydia Impactor from here and save them to a folder on your Mac.




Step Two
Double click to open the Impactor dmg.


Step Three
Drag and drop the Impactor app onto the Applications folder shortcut.


Step Four
Launch Impactor from your Applications folder. Click Open if asked to confirm.


Step Five
Plug in the power cable and connect your Apple TV to your computer via USB.

Drag and drop the liberTV IPA downloaded earlier into the Cydia Impactor app.


Step Six
You will be asked to enter your Apple ID and password. This is only used to sign the IPA, letting it run on your device.




Step Seven
Cydia Impactor will sign the IPA and install the new liberTV jailbreak app on your device.


Step Eight
Disconnect the Apple TV from your computer and connect it to your TV using HDMI then launch the liberTV app.


Step Nine
Click the Click Me button.


Step Ten
Your device will now be jailbroken! Click the Done button once the process has completed.


Step Eleven
You can now SSH into your device using its IP address, the user 'root', and the password 'alpine'. Once logged it, you should change the root password.

To get the full binpack, enter the following command:
export PATH=$PATH:/jb/usr/bin:/jb/bin:/jb/sbin:/jb/usr/sbin:/jb/usr/local/bin:


● As the screenshot shows, merely setting the path automatically gets you all the binpack (and some fresh binaries at that).
● To enable scp , you have to cp /jb/usr/bin/scp /usr/bin because that's done using a server side binary which must be in dropbear's path
● You can run any self signed binary you want, provided you sign it with the latest jtool - jtool --sign platform --ent plat.ent --inplace binary, with plat.ent being the same entitlements you get from jtool --ent on any of the binpack binaries

A big thanks to Jonathan Levin, Ian Beer, Pangu and everyone else who had a hand in creating this jailbreak.

Please follow iClarified on Twitter, Facebook, or RSS for updates.