Another option for tivo modification?

[slothman]

After reading a lot about how to modify the tivo so that you can get a bash prompt, the only thing I found was that you had to open the case to do it. While most people won't mind doing such a thing, I'd be rather uneasy possibly throwing $100+ down the drain. My idea is to use the tivo modem, which works on all tivos by default and make it call YOU. How to do this? Well its pretty simple actually. The hard part is impersonating the ip address that the tivo will contact. First get a phone that has a perfect mute on it. Meaning it doesn't lower the volume, it really mutes it. This is important because when the modems are talking together there cannot be any input to disrupt them. Next get a digital recorder or something that can generate a dial tone sound. Now you need to setup your computer to act as a dialup server. Make sure it will accept any username/password. Now take the phone and leave it off the hook. Wait until after that harsh beeping tone goes away. Now force the the tivo to make a call. Quickly get to the other phone and play your dial tone into the handset. After the tivo dials you need to manually answer the call on your computer. The tivo should connect and authenticate itself to your server. Now at this point I am unsure of how to make your computer impersonate the tivo ip address. Possibly with the use of ip aliases, but I'm not sure it can impersonate an ip address that's not on its subnet natively. Another hack might be required here. You probably might need to use linux. My main motivation for this is to modify the rc.sysinit so I can get a bash shell. I think that this is definitely possible through the tivo modem as you can receive system upgrades and whatnot through it.

[v8q]

That sure is a lot of work to go through - just to avoid removing some screws. Are you sure it is worth it?

[slothman]

You'd be surprised how far someone will go just to save $1. But really, it isn't that hard to setup. As I said before, the hardest part will be impersonating the ip address. I plan to try this before I look for the torx.

[BubbleLamp]

Well unless you can duplicate the crypto authentication functions of the Tivo head end, you aren't going to get very far.

You can open the box without damaging the warranty label a thousand times easier than what you propose.

Also, if this is a DTivo, you'll have to do a lot more than modify the rc.sysinit to get bash.

[slothman]

Well I guess you're right. I forgot about the crypto stuff it uses internally. That would be a real bitch to go thru the source and figure out. It could still be done, but at the moment I guess there's no need. There might be if 3.0 screws up everything. Or if you find yourself having to open it up every day. Also, didn't you mean if its a DTivo running 2.5 you'll have to do a lot more than modify the rc.sysinit to get bash? I think 2.0 is much easier in that regard.

[BubbleLamp]

Originally posted by slothman
Also, didn't you mean if its a DTivo running 2.5 you'll have to do a lot more than modify the rc.sysinit to get bash? I think 2.0 is much easier in that regard.

Correct, but who wants a DTivo with only one working tuner? :D

[slothman]

I just thought of something else, why not use the tivo modem, serial port and ir port for multilink ppp? This would be awesome if it could be done, anything to speed up the 115k limit on serial. Currently it takes almost 2 days to transfer over a 2hr movie. I think the ir port can do 115k also (not sure), the modem is a 33.6 so it would be less than a day if this setup would work. I would definitely prefer this over a $70 turbonet. I've heard some people talk about using the ir port for this sort of thing, but nothing concrete. As soon as I can play around with it a little, I'll report my findings.

[BubbleLamp]

You've got to be kidding. Are you just a glutton for punishment? Best of luck with that.

[logicTrAp]

Good lord. Even if you went through all of this, what makes you think you would have a bash prompt simply by convincing your tivo to dial you? It doesn't run a telnet server by default, so you would have to somehow fool it into downloading a fake "update" or something.