Update: tvOS 11.2.6 is now unsigned. You can no longer use futurerestore to restore any device to any firmware below tvOS 11.3. Do not attempt the restores mentioned in this article.

After using nitoTV on the tvOS 10.2.2 greeng0blin jailbreak for a while, I’ve decided it’s not quite there for me yet. With the ability to sideload my favourite movie-watching and media streaming apps without a jailbreak, and very few other tweaks yet available on nitoTV, the downsides outweigh the benefits of having a tvOS 10.2.2 jailbreak.

Apps such as YouTube don’t work for me, and app support is being dropped fast, much faster than in the iOS world. Many of the tweaks and apps on nitoTV try to avoid this problem, by offering an alternative to YouTube, or forcing the Netflix app to run on tvOS 10. However, they need only exist because of being on tvOS 10 in the first place, and wouldn’t be necessary on tvOS 11, with a newer jailbreak.

Aside from those offerings, the tweaks on the nitoTV store are not deal-breakers, and stock tvOS 11 introduces many features over tvOS 10. I’d gladly stay on iOS 10 if it meant having a jailbreak, but the attractiveness of the features in tvOS 11 is far greater, and the utility of a jailbreak far weaker, making the overall dynamic very different.

With that in mind, and with the opportunity to move from tvOS 10 to tvOS 11 via futurerestore fading fast, I’ve decided to show you how to jump between the versions, should you decide to. Remember, once tvOS 11.2.6 goes unsigned you will not be able to move to tvOS 11.0-11.1 at all, but must stay on tvOS 10 and wait for the next tvOS jailbreak to come along…

How to restore from jailbroken tvOS 10 to tvOS 11.0-11.1 on Apple TV 4

1) Check that tvOS 11.2.6 is still signed before beginning, and download its IPSW.

2) Download the tvOS 11.0 or tvOS 11.1 IPSW too, depending on which firmware you have .shsh2 blobs saved for. If you have both, go with tvOS 11.1.

3) Jailbreak on tvOS 10. This could be with LiberTV for 10.0-10.1, or with greeng0blin for tvOS 10.2.2. You’ll need to be in jailbroken mode to SSH into your Apple TV and set your nonce. 

4) Create a folder on your computer Desktop called futurerestore. Place your two firmware files and your saved .shsh2 blob inside it. You’ll also need the futurerestore tool itself in there.

5) Rename the tvOS 11.2.6.ipsw to .zip, then double-click to extract it. Inside, find BuildManifest.plist, and copy it to the root of your futurerestore folder, along with your other assembled files.

6) Next, look in your expanded .zip in Firmware/all_flash for your sep-firmware.im4p. If there are several, you will need the one which matches your Apple TV. For example, the Apple TV 4’s identity is J42dAP, so you would take the file called sep-firmware.j42d.RELEASE.im4p. Make sure you select the correct SEP file for your hardware, and take .im4p not .plist. Copy that into your futurerestore folder too.

7) You can now delete the expanded .zip folder, and the 11.2.6.zip itself if you like. Your futurerestore folder should now contain the following files:

  • Your destination firmware IPSW, either tvOS 11.1 or tvOS 11.0, depending on which blobs you have.
  • Your matching saved .shsh2 blob, either tvOS 11.1 or tvOS 11.0.
  • The futurerestore tool.
  • The BuildManifest.plist taken from the tvOS 11.2.6 IPSW.
  • The sep-firmware.im4p taken from the tvOS 11.2.6 IPSW.

8) Connect your Apple TV to your computer via USB-C cable. Open a Terminal window on your Mac and SSH into your Apple TV. Instructions on how to do so can be found in my guide.

9) Find the nonce you wish to set. To do this, open up the .shsh2 blob in your futurerestore folder. Any .plist editor or Quick Look will do for this. Copy and paste the generator field somewhere safe. It will be a string such as:

0xc3e056a6a88f49f5

(Do not use mine, it will not work.)

10) Set this nonce on your Apple TV: in the SSH Terminal window, type:

nvram com.apple.System.boot-nonce=YOUR_BOOT_NONCE

Replace YOUR_BOOT_NONCE with your generator from Step 3, for example:

nvram com.apple.System.boot-nonce=0xc3e056a6a88f49f5

Note: If setting your nonce in this step is not successful, do not continue as the process will not work. Your jailbreak may not have disabled nvram protection, which is necessary to set the nonce. On tvOS 10.2.2, greeng0blin does this automatically so entering the commands should be enough, but on other jailbreaks you may require additional tools to edit nvram and set the nonce.

Check out Siguza’s iOS-kern-utils, nvpatch, or tihmstar’s nonceEnabler if you find yourself unable to set nvram variables.

11) Once the command is successfully entered, type nvram -p to check the nonce has been set. In the list of nvram variables, you should now see your boot nonce listed. Leave the SSH window running, and open a new Terminal window on your computer.

12) In the new window, cd into the futurerestore folder we made in Step 4. Now write out but do not enter the following command, replacing the file-names with your own equivalents. The easiest way to do this is to type the first few letters of the file-name, then hit TAB to auto-complete it without typos. Do not enter it yet.

./futurerestore -t YOUR_SAVED_BLOB.shsh2 -s YOUR_HARDWARE_sep-firmware.im4p -m BuildManifest.plist YOUR_DESTINATION_FIRMWARE.ipsw --no-baseband

Note: This command will only work while tvOS 11.2.6 is still being signed. When tvOS 11.3(+)/tvOS 12.x are the only signed firmwares, the process will not work. If you read this article after tvOS 11.2.6 is no longer signed, do not proceed with the process, but remain on your current jailbroken firmware.

13) Once the command is ready, return to the SSH Terminal window from Step 8, and enter:

nvram auto-boot=false

Type nvram -p again to check that both the boot nonce and the auto-boot flag are visible. If they are, type reboot to put your Apple TV into recovery mode.

Note: If the reboot command doesn’t work, simply move onto the next step. It shouldn’t make a difference.

14) Once in recovery mode (or not, depending on whether the reboot command was available), return to the futurerestore Terminal window from Step 12 and hit Enter on the futurerestore command.

15) The restore process should now begin. With luck, it will succeed and you will end up freshly restored to tvOS 11.0-11.1. From there, you can enjoy tvOS 11 features, use LiberTV to enjoy sideloaded apps without expiry, and wait for a tvOS 11 update to nitoTV. Remember to follow my guide once on tvOS 11 to prevent unwanted accidental updates!

Is your tvOS 10 jailbreak more valuable to you than tvOS 11? Are you going to make the jump to tvOS 11 in time? Let me know below.

If you have any problems with this guide, refer to my more in-depth futurerestore guide for more details, but remember that it concerns iOS rather than tvOS, so some common sense is required in working between the two. Do not follow all the steps blindly on tvOS.