PDA

View Full Version : Killhdinitrd SA S2 24004A with 7.2


ScanMan
03-17-2006, 05:10 PM
Since it seems a rite of passage to post one's experiences/results, here are mine. I had to glean information from various threads and I figured it might help some folks embarking on this to have most of it in one place. My specific unit is the 24004A with software rev. 7.2.1 but this will work for 240040 and any other tivos that begin with 240.

I don't want to preach but some words of wisdom. Read, learn, understand what you are doing. Read the killhdinitrd release thread here (http://www.dealdatabase.com/forum/showthread.php?t=36692) and also the killhdinitrd support thread here. (http://www.dealdatabase.com/forum/showthread.php?t=36693)

Map out your plan, make notes. Make sure you have a FAT/FAT32 partition on your PC. This pre-planning will make things a LOT easier. Some familiarity with linux/unix helps too. You will need a boot cd and a proper kernel that already has killhdinitrd applied to it or one you will apply yourself. The folks at PTVUpgrade have a boot disk with pre-modded kernels for $5 here (http://www.ptvupgrade.com/products/software/lba48/index.html) Or if you already have the correct kernel you can use the free lba48 boot disk at the same URL. You will also need some tools - one great source is Alphawolf's All-In-One binaries for the series2 found here. (http://www.dealdatabase.com/forum/showthread.php?p=189482&highlight=crond) You also might want some other utilities found at sourceforge here. (http://tivoutils.sourceforge.net/)

The following assumes you already have the boot cd, tools and most importantly the kernel you will be using. You surely should have made a backup image and tested it before you start - see Hinsdale's howto here (http://www.newreleasesvideo.com/hinsdale-how-to/) for pointers. Also, since we are installing telnet and ftpd, I assume you have a USB ethernet adapter. I have used the older Linksys 100M and also the Netgear FA120. For a list of compatible adapters see tivo.com. (http://customersupport.tivo.com/knowbase/root/public/tv2006.htm?) Some details may have been left out, you are hereby warned...

I chose to use a 3.1.5 kernel that already had killhdinitrd applied to it; many are now using the newer "7.2.2-oth.K1" killhdinitrd kernel which supports DHCP without additional modules. See notes below on DHCP.

Now on to the goods...

-----Hack TiVo SA S2 "240"-----

1. Attach your tivo hard drive to your pc as "secondary master" and boot from ptvlba48 cdrom; your tivo hard drive should show up as /dev/hdc in the boot messages (dmesg). The following is based on my tivo hard drive located in the secondary master position (/dev/hdc); if you have your tivo drive in another location, edit accordingly. You can generally mount the 4th, 7th and 9th partitions on a tivo drive; sometimes either the 4th or 7th doesn't exist (especially after an mfstools backup/restore).

Check what your current "root" is:

bootpage -p /dev/hdc

*output will either be hda4 or hda7 - mine was /dev/hda4 and we'll use that throughout; if your root is /dev/hda7 you will need to adjust accordingly.

Make a mount point and mount the drive

mkdir /mnt4
mount /dev/hdc4 /mnt4

2. Now dd in the killhdinitrd kernel to the appropriate partition

If result of Step 1 was "/dev/hda4" then dd if=/path/to/vmlinux.px of=/dev/hdc3
If result of Step 1 was "/dev/hda7" then dd if=/path/to/vmlinux.px of=/dev/hdc6

3. Write new bootpage params to kernel

bootpage -P "root=/dev/hda4 dsscon=true console=2,115200 upgradesoftware=false" -C /dev/hdc

--those are capital P & C; it should be hda4 or hda7 depending on bootpage -p output; the 'root=/dev/hda[4or7]' should always be hda as it is the Primary Master IN THE TIVO! It should never be any letter other than a. The /dev/hdc after the -C is the letter of tivo hard drive when it is installed in your PC.

4. Edit IPTABLES

Two ways to do this:
a.
cd to /sbin on mounted "root" partition; i.e., cd /mnt4/sbin

mv iptables iptables.old
echo -e '#!/bin/bash\nexit 0' > iptables
chmod 755 iptables

*That's a zero above - \n (newline) exit 0 - your file should look like this when done:

#!/bin/bash
exit 0

*Doublecheck it, this is the source of many errors...

b. Easier way to "fix" iptables...
insert the command:
iptables -FEarly in your rc.sysinit.author - see below...

5. Create rc.sysinit.author

cd to /etc/rc.d on mounted "root"; i.e., cd /mnt4/etc/rc.d
touch rc.sysinit.author
chmod 755 rc.sysinit.author
vi rc.sysinit.author
#!/bin/bash
export PATH=$PATH:/hacks
iptables -F
tnlited 23 /bin/bash -login &
setsid /bin/bash --login -i</dev/ttyS2&>/dev/ttyS2&
tivoftpd&

6. Move in some hacks

--I like to have my utils right in bin--
cp /path/to/ls /mnt4/bin
cp /path/to/vi /mnt4/bin
cp /path/to/setsid /mnt4/bin
chmod 755 (all of the above) --do this for each

--Make a directory for your hacks on the root partition--
*Most people recommend you put your hacks in the root because the /var directory can be overwritten by tivo

mkdir /mnt4/hacks --this name should match what you typed in rc.sysinit.author
cp tivoftpd /mnt4/hacks
chmod 755 /mnt4/hacks/tivoftpd

7. Notes on USB network drivers and 8.x Software

With the release of 8.x software, there is an apparent incompatibility between the stock tivo network drivers and the killhdinitrd kernels - reference 8.1 and my NIC (http://www.dealdatabase.com/forum/showthread.php?t=51874) thread. The incompatibility can be resolved by using Jamie's Backport Drivers (http://www.dealdatabase.com/forum/showthread.php?t=38167). You'll need to copy the "host" drivers as well as the specific driver for your USB NIC. Read Jamie's README and look at your /etc/hotplug/usb.map for more info.

*Finish

cd /
umount -f -a -r
halt

You should now have tivo booted with serial bash, telnet and tivoftpd running. Whatever else you want to do you should be in good shape.

**Notes on DHCP
The DHCP client (dhclient) does not work correctly with a killhdinitrd 3.1.5 kernel on 7.X software; read why here. (http://www.dealdatabase.com/forum/showthread.php?t=48150)
Two solutions, use a static IP address entered in the Tivo GUI - navigate through "Network Settings" and enter a static ip address that matches your subnet. Or, if you would like to regain DHCP functionality with the 3.1.5 kernel, read how here. (http://www.dealdatabase.com/forum/showthread.php?t=51000)
You can can also use the "7.2.2-oth.K1" killhdinitrd kernel with built-in DHCP support.

***Notes on Serial Bash/Channel Changing***

If you plan on using the tivo serial port + cable to change channels, as with the Motorola cable box, you will need to disable the 'setsid /bin/bash --login -i</dev/ttyS2&>/dev/ttyS2&' line by placing a comment symbol (#) in front of this line or deleting it all together. Directing /bin/bash to the serial port will screw up your channel changing and cause the tivo to reboot when you try to change channels.

***Last but not Least - Serial Output***

I spent more time working on getting serial cable output than anything else. Here's what finally worked for me - I used the serial cable from 9th tee (http://www.9thtee.com/tivoreplacementparts.htm), with a radioshack null modem adapter plus a radioshack female-to-female gender changer. You could also make your own serial cable with instructions here. (http://www.dealdatabase.com/forum/showthread.php?t=9724) I had a lot of problems getting output and it only worked when I used the "setsid" utility in Alphawolf's binaries (link above) and included the line above in rc.sysinit.author. For general help with serial console output see here; (http://www.dealdatabase.com/forum/showthread.php?t=45059) The specific thread I used in reaching my solution with setsid is here. (http://www.dealdatabase.com/forum/showthread.php?t=45244) The bonus is you end up with serial bash in case someday you need to get in for repairs and you don't have telnet...

Best of luck, hope it helps and feel free to question, comment, etc.

Peace, out.

ocntscha
03-17-2006, 07:55 PM
tnlited 23 /bin/bash -login &
setsid /bin/bash --login -i</dev/ttyS2&>/dev/ttyS2&

The bonus is you end up with serial bash in case someday you need to get in for repairs and you don't have telnet...
Congrats on the successful hacking, and nice of you to type up some notes for those following in your foot steps. I do have a comment. With that setup the likelihood of being able to get in via the serial port for repairs in the event you can't get in via telnet is very very low. If the Tivo can't boot far enough to start the telnet daemon then the bash on the serial port isn't going to be started either.

ScanMan
03-17-2006, 10:31 PM
Good point; if rc.sysinit & rc.sysinit.author cannot complete you'll never get to serial bash since the boot aborts. It's still useful if you successfuly boot but your usb/ethernet drivers don't load correctly though right?

Jamie
03-18-2006, 01:36 AM
Serial console access is especially valuable when you've messed things up so badly that your box won't boot at all: it gives you access to the PROM menu where you can boot with the alternate root. Just be sure you've set the prom password with crypto and have a working alternate root setup.

PlainBill
03-18-2006, 01:56 PM
Well done, and a request. You've done a pretty good job documenting what you did, but more information would be useful. I'd suggest you add links similar to what Cheer did in his roadmap (http://www.dealdatabase.com/forum/showthread.php?t=43599).

Also, it appears this should also work with the TCD140xxx TiVos if the appropriate 7.2.2-oth-K1 kernel and killhdinitrd 0.9.3. This also will allow use of dhcp.

PlainBill

Offspring2099
04-01-2006, 03:27 PM
export PATH=$PATH:/var/hacks
tnlited 23 /bin/bash -login &
setsid /bin/bash --login -i</dev/ttyS2&>/dev/ttyS2&
/var/hacks/tivoftpd&


scanman,

Since you already included /var/hacks in your path: 'export PATH=$PATH:/var/hacks', can't you just invoke tivoftpd /wout using the full path '/var/hacks/tivoftpd'. Isn't that the whole point of the including the path?

ScanMan
04-01-2006, 03:41 PM
Yes, I guess I was being overcautious...

joverby540
05-03-2006, 11:06 PM
Thanks for posting this. I was able to get my tcd240080 w/ 7.2 hacked. I had problems the first time because I was adding spaces where they were not needed in the rc.sysinit.author, but I copied the text over to word and I was able to read it correctly. The only problem I could find with the instructions is that it would say something like "cd /mnt4/sbin" where you would really need to type "cd /mnt/mnt4/sbin".

ScanMan
05-03-2006, 11:24 PM
The mount points depend on where you create/mount them. In my notes I created mount points right off the root.

mkdir /mnt4
mount /dev/hdc4 /mnt4

The root (/) filesystem on the 4th partition would now be mounted at /mnt4. So everything is relative to that. You could create them at /mnt/mnt4 as I have seen other guides do. Whatever works...glad the notes helped!

caliman002
12-14-2006, 01:42 PM
what happen,i can not get out!!!
vi rc.sysinit.author
~
~
~
~
rc.sysinit.author [modified] line 7 of 7 ....100%
hihi ,i donot know what i am doing

ScanMan
12-14-2006, 02:42 PM
what happen,i can not get out!!!
vi rc.sysinit.author
~
~
~
~
rc.sysinit.author [modified] line 7 of 7 ....100%
hihi ,i donot know what i am doing
You're using the 'vi' editor; you can use another editor you're more comfortable with if you like (like joe, etc.) If you're not comfortable with any unix editor, you can use google to learn some 'vi' commands or create the 'rc.sysinit.author' file in a windows text editor - just make sure you can save the file as "unix" - I wouldn't recommend notepad or wordpad, they will leave you with DOS-style line endings and your script will fail. Metapad is a freeware text editor that is unix-aware and easy to use.

p.s. ":wq" (that's colon, w, q) will write and quit the file. Or ":q!" will quit discarding changes.

Also, Captain Video's "Tivo Hacking 101" is a great place to start!!!

TerminalE
12-20-2006, 07:43 PM
Just want to confirm this cannot be done on a TCD540040?

ScanMan
12-20-2006, 10:47 PM
Correct; killhdinitrd does not work on 540 tivos. They require a PROM modification to bypass the chain of trust. Check out the PROM socketing thread. Once the PROM is replaced with hacked code to bypass the chain of trust, you can install a kernel that has the initrd replaced with a null one and then proceed to obtain bash, start telnet, ftpd and hack to your heart's content.

Snafoo
04-23-2007, 01:55 PM
Will this process be the same with 8.1 software on my TCD240?

ScanMan
04-23-2007, 08:36 PM
Yes, the process is the same. The only consideration is using the '7.2.2-oth.K1' kernel instead of the 3.1.5. The significant difference is the '7.2.2-oth.K1' supports DHCP out of the box without the need for additional modules. Oh and the other thing is to use the backport drivers (http://www.dealdatabase.com/forum/showthread.php?t=38167) instead of the stock USB network drivers which after 8.x are incompatible with the killhdinitrd kernels mentioned. See the "8.1 and my NIC (http://www.dealdatabase.com/forum/showthread.php?t=51874)" thead for more info.

Snafoo
04-24-2007, 11:53 PM
Tivo model: TCD240040
PTVUpgrade LBA48 boot CD
250gb hard drive installed and tested as working

I get the "Welcome" screen then the "Almost there" then reboot, repeat.

This is what I've done.

I restored an image to a 250gb HDD.
Install and boot tivo, setup and run for a week with no problems.

Just now I performed Scanmans hack on my TCD240.
Bootpage told me that hda7 was root so I used that in my commands.

Tivo connected as hda, CD-Rom setup as hdc and WinMe hard drive setup as hdd with vmlinux.px & tivotools on it.

Any help with this is greatly appreciated.

ScanMan
04-25-2007, 10:05 AM
Couple of things:

1. Error in transferring killhdinitrd kernel
2. Didn't properly fix iptables
3. Didn't copy backport drivers

More exact info on what you did would help, as well as console boot log.

Snafoo
04-25-2007, 03:08 PM
So the backport drivers could cause this even if I don't plug in the USB cable?

I'll pull the drive this evening and check the iptable and add the backport drivers.

Scanman, I really appreciate your help on this and I'll post my results tonight.

ScanMan
04-25-2007, 03:49 PM
So the backport drivers could cause this even if I don't plug in the USB cable?
No, if the USB NIC is not plugged in, it should boot properly. Really try to get a console boot log. If you are not set up for serial (I won't preach the importance of it :D ) you can get it from the 9th partition (/var) while the tivo drive is in your PC - it's the file named kernel in the /log directory. Post it as an attachment.

Snafoo
05-10-2007, 10:25 PM
Here is my kernel log from hda9.
<added .tcl to file to upload>

I get this error just before it reboots<i think>
Tmk Fatal Error: Activity TvBusProxy <83> strayed

ScanMan
05-10-2007, 11:52 PM
It certainly looks like an iptables error. How did you fix iptables? One way to fix your /sbin/iptables is to create a file that looks like:
#!/bin/bash
exit 0
Make sure it is chmod 755

The other thing you could do is restore your original iptables and place
iptables -Fright after your path statement in rc.sysinit.author. In that case, you don't need the "exit 0" fix above.

Snafoo
05-11-2007, 12:13 PM
It certainly looks like an iptables error. How did you fix iptables? One way to fix your /sbin/iptables is to create a file that looks like:
#!/bin/bash
exit 0
Make sure it is chmod 755

The other thing you could do is restore your original iptables and place
iptables -Fright after your path statement in rc.sysinit.author. In that case, you don't need the "exit 0" fix above.

I added the iptables -F to my rc.sysinit.author file. I'll check it to make sure it is after the path statement.

Is one way better than the other?

Narf54321
05-12-2007, 03:39 AM
Personally, I think the iptables -F method is easier to maintain. If it remains in your rc.sysinit.author file, that's one less thing to worry about when manually upgrading the system software.

Keeping a working iptables binary also allows one to try more advanced network filtering features, if you wish.

Snafoo
05-12-2007, 01:59 PM
I had the iptables -F in my rc.sysinit.author file but I still got the reboot.
I deleted the iptables -F entry and created the empty iptables file from scanmans guide and I'm not rebooting anymore unless I plug in my USB NIC.

I'm researching the backport drivers now to fix that.
Do I have to compile my own drivers or are they already created?

Thanks Scanman for all your help.

jt1134
05-12-2007, 08:59 PM
You can compile your own if you want to. Otherwise jamie compiled them a while back. They work great. Files here : http://www.dealdatabase.com/forum/showthread.php?p=279211#post279211
Support thread here : http://www.dealdatabase.com/forum/showthread.php?t=44114

Snafoo
05-14-2007, 10:33 AM
I'm using a Linksys USB100TX wired NIC.

To get it to work I replaced everything in /platform/lib/modules with the backport modules.
I replaced pegasus.o, usbnet.o & usb-storage.o in /lib/modules.

Now I'm connected through the network.:D

seansros
08-06-2007, 02:06 PM
welcome powering up stock right there . I did unplug & plug the ac. power . Still stock at tthis point. can anybody give me a clue where to look for. appreciated

PlainBill
08-06-2007, 06:08 PM
welcome powering up stock right there . I did unplug & plug the ac. power . Still stock at tthis point. can anybody give me a clue where to look for. appreciated

The serial console output (http://www.dealdatabase.com/forum/showthread.php?p=234467#post234467) is a big help. Attach it to your post.

acmessina
02-13-2008, 06:10 PM
Philips DSR704. (using instantcake and PTVnet) I am trying zipper

I am using the zipper to install hacks, it all goes fine till I get this message

copying hacked kernel to tivo drive...
cd: /cdrom/s2_kernels/3.1.5/vmlinux.px.gz: no such file or directory
hacked kernel not found on zipper cd in /s2_kernels/3.1.5/.
make sure you have the latest lba48 cd with killhdintrd kernels.
aborting
PTVupgrade /cdrom

What the hell am I doing wrong, and what can I do to correct it, PLease let me know.
I have instantcake and PTVnet as well, but cant get networking to work either. Thanks

rbautch
02-13-2008, 07:04 PM
What the hell am I doing wrong, and what can I do to correct it, PLease let me know.For starters, you didn't follow the directions that beseech you not to ask Zipper questions here, you haven't searched for answers on your problem, and you've hijacked a thread that has nothing to do with your issue. DVRupgrade has it's own forums for PTVnet support.