PDA

View Full Version : Nuked CSO key recoverable?



AbMagFab
09-26-2004, 02:18 PM
I have some scrambled recordings that I want to watch (recorded this week between 3.1.5d activation and my rehacking of the box), and I manged to run csoscout.tcl in a way that it nuked all CSO keys (not just unscrambled shows). Is there any way to recover the nuked keys for the scrambled shows? Can I just set the CSO key to any value (non zero) and will the Tivo be able to play them?

Or am I screwed? Darn them for doing this during the first week of a new season...

This is on an HD Tivo, 3.1.5d.

Thanks,
Mark

ronnythunder
09-26-2004, 04:35 PM
you're screwed. they call them cso *keys* for a reason - they're literally the keys that are (ultimately) used to decrypt the scrambled data in the file parts.

ronny

AlphaWolf
09-26-2004, 04:36 PM
I have some scrambled recordings that I want to watch (recorded this week between 3.1.5d activation and my rehacking of the box), and I manged to run csoscout.tcl in a way that it nuked all CSO keys (not just unscrambled shows).

Now how did you do that?

Once they are gone, buddy believe me they are gone. The only *possible* way of recovering them would be to dump the entire hard disk and figure out some way to undelete attributes, which I don't think anybody has ever tried thus it wouldn't be documented anywhere.

AbMagFab
09-26-2004, 08:05 PM
Now how did you do that?

Well, I was happy at how quickly my rehack went to 3.1.5d. Also, I think since I let it fully patch to 'd' before copying the old 3.1.5 kernel over, it won't get caught into the "Pending Restart" each time it calls (although that's disabled atm anyway). All my TyDb entries say 3.1.5d.

Anyway, so I came home from a ball game, decided to log in and run csoscout.tcl again for good measure (for no apparent reason). It ran. I then went downstairs to finish watching Smallville, which was paused from earlier in the day, and was encrypted (and was a great show, btw). It finished playing just fine. Then went to play CSI, and *bong*. Tried a couple others from the encrypted period, and *bong*.

Logged into the HD Tivo, ran ciphercheck.tcl, failed, added mfs_ftp to my path, ran again, and saw the "Yes No". Darn. Then I realized when I ran csoscout.tcl, I didn't have mfs_ftp in my path. So I logged out, back in, ran csoscout.tcl without mfs_ftp in my path, and sure enough it ran.

I could have sworn that csoscout.tcl wouldn't run without mfs_ftp in the path, but it did. I have since added mfs_ftp to my default path to avoid this in the future, but since you asked - that's how it happened.

Would be nice if for the future, csoscout.tcl had some safety check for this? If this doesn't make sense, let me know and I'll dig deeper to see how it could run without mfs_ftp in my path. Frankly, I didn't do much more investigation since I'm just bummed, and will now go delete CSI, CSI:NY, Medical Investigation, Law & Order x 2, Lost, O.C., and a couple of shows I can't watch now.

:(

AlphaWolf
09-26-2004, 09:28 PM
I don't see how it could have possibly deleted those attributes without some kind of modification to the script. The reason why is because the method with which it detects a non encrypted stream is the safety mechanism in itself. The result of the magic number scan must be an exact match, if it isn't then the stream is assumed to be encrypted and nothing is done. Theres no way you can even get a match if mfs_export isn't working.

See the post I made a few days ago describing the details of what both of those scripts do.

ronnythunder
09-26-2004, 10:17 PM
so before you delete all of them, have you looked to see if indeed the cso attrs are nuked? perhaps something else is wrong (bad tivoapp patch)?

ronny

rc3105
09-26-2004, 11:40 PM
Or am I screwed? Darn them for doing this during the first week of a new season...

first, check the cso keys via tivoweb

http://my_tivo/mfs/Recording/NowShowingByClassic - recfsid - part



RecordingPart 336027/13 {
CommercialSkipOffset = 0
File = 351722
Begin = 0
End = 1678293
}


to see if they're actually gone (changed to 0)

if the keys are gone from mfs, check /var/mfs_ftp/cache/*.xml to see if the CommercialSkipOffset values there are valid or have been zeroed


if they still exist in mfs you have some other problem

gone from mfs but valid in cache == restorable

AlphaWolf
09-27-2004, 02:42 AM
if the keys are gone from mfs, check /var/mfs_ftp/cache/*.xml to see if the CommercialSkipOffset values there are valid or have been zeroed

Ah now that is something I definitely forgot about. The thing to do then is write a script that can replace those values back into MFS. Or if you want to do it the long way, extract those streams as they currently stand (in TMF mode preferably,) then reinsert duplicates of them, and the duplicates should play back fine.

AbMagFab
09-27-2004, 02:50 PM
Well, I already deleted them, but I just restored one to check it out and:

- There is no CSO entry, just File, Begin, and End (probably since it doesn't restore 0 items in the process)

- I deleted the mfs_ftp cache in the process to see if that was causing the problem... so sad...

It's okay, I watch too much TV anyway! And season openers aren't usually that great (go with me on this...).

jonbig
09-27-2004, 05:59 PM
If you made a backup image of your system with MfsTools, you can recover the key from the backup.

AbMagFab
09-27-2004, 06:57 PM
If you made a backup image of your system with MfsTools, you can recover the key from the backup.

Yet another good idea, and yet another safety measure I didn't take... :rolleyes: I'm not too upset, since, to your point, if I cared enough about old recordings, I would have made some sort of backup before re-hacking.

And I didn't.

So it's my fault.

At least now I know more about CSO keys than I did before!