PDA

View Full Version : TivoHD -- my 1st attempt



mlcarson
06-28-2009, 08:29 PM
This is my personal experience with hacking the TivoHD so that I can transfer all files to my personal computer rather than only those deemed by the local cable company as not copy protected.
The first step was to get a prom socket placed on my TivoHD and have a prom programmed so that files could be modified/added to the hard drive. I used Omikron's service on this website -- http://www.dealdatabase.com/forum/showthread.php?t=53722. The work seemed professional and the unit arrived back quickly. I plugged the Tivo back in without making any changes and verified it still worked as expected and it did. So, my TivoHD is now hackable but the process is not documented very well due to the history of the board with hacking the series 1, 2, and 3. Those that hacked the earlier series already knew the terminology, tools, and methods involved. For those getting started with a TivoHD, it's more confusing and I believe there's an intentional barrier of entry or there would be more posts like this. The revised index is nice but I would have preferred more recent stories regarding my specific hardware -- the TivoHD. So, I'm going to outline my story so far....
Hardware
Tivo: TivoHD
PC: Gigabyte GA-EP45-DS3R
Drives:
Sata0: 640GB HD (internal)
Sata1: 640GB HD (internal)
Sata2: 640GB HD (internal)
Sata3: unused
Sata4: CD/DVD drive
Sata5: External Icy Dock EZ-Dock
OS: Windows 7 RC1
AHCI: Native -- not legacy

I had already upgraded my Tivo's HD to a 1TB WD10EADS the first day I had purchased it. I used the program WinMFS to copy my original TivoHD drive to the new drive. The program is located at www.mfslive.org and the documentation is more than adequate to explain how to upgrade your Tivo's HD. I used this same program though in my first step of my hacking progress.

So, use a Torx T10 screwdriver to open the TivoHD. Remove the HD bay (4 screws). Remove the HD from the bay (4 screws). I wanted the bare HD so I could simply drop it in my SATA EZ-Dock. Run the WinMFS program as Administrator -- if you don't run as Administrator it will show no drives. I backed up the Tivo Drive to a TivoHD-truncated TBK image (450,942KB). I backed up the Bootpage to a TivoHD-bootpage.tbp file (1KB). I backed up the kernel to a TivoHD-active-kernel.tak file (1,879KB). I've not had to use any of these yet but it's good insurance. While in WinMFS, I printed a copy of the MFSINFO Partition maps (15 paritions). This was an important reference later for me. So, we have some backups and a partition map at this point.

Next, download the MFSLive Linux Boot CD ISO and burn it to a CD. This is the OS from which we'll do the actual Tivo Hacking. There may be a way of using VMWare to boot off the CD ISO and to point the virtual machine at the physical SATA drive connection so you can have Windows up at the same time -- I may look into this later. But I had a second PC available for perusing the Internet for help while using the MFSLive Linux Boot CD so didn't really need the Vmware option.

Next, we need to download the various tools we'll need and burn them to a second CD. I decided I wanted to replace the kernel with a prebuilt custom kernel. See Files - All Tivo & DTivo Files -> Custom Kernels thread (http://www.dealdatabase.com/forum/showthread.php?t=54047). The TivoHD is a GEN06 device so we need a GEN06 kernel. I chose the Gen06-netopt-ext3.tar.bz2 image. http://www.dealdatabase.com/forum/attachment.php?attachmentid=6852&d=1225075964

We also need Tivotools.tar (http://www.dealdatabase.com/forum/attachment.php?attachmentid=5975&d=1166725883) to enable FTP and to add a lot of other misc utilities. See thread: http://dealdatabase.com/forum/showthread.php?t=37602

And our ultimate goal is to patch the Tivoapp to disable the encryption and the CCI flag. The latest tool for this appears to be the tvapppatch.tcl tool (v1.7) with patches contained in tvapppatches.tcl.

I used the tvapppatches-11.0c.tcl (http://www.dealdatabase.com/forum/attachment.php?attachmentid=7028&d=1240142449) since my TivoHD is using SW version 11.0c. It's located in this thread http://www.dealdatabase.com/forum/showthread.php?t=60303&page=2. I downloaded the app from this thread http://www.dealdatabase.com/forum/showthread.php?t=60304 which appears to be the official release thread and is at version 1.7. The patches file in this thread seems to be at version 1.1b and supports up to SW 11.0 but not 11.0c so this is why I used the 4/19/09 11.0c version.

I believe the above files are the only ones I needed to burn to CD. After I had these files burned, I booted off the MFS Live Linux Boot CD with my Tivo hard drive in the Icy Dock. The CD prompts for options 1-4. I chose option 1 which is the default option and claims it's the graphic option. The only graphics I remember seeing were different text colors. You're being placed at a Linux command prompt -- not some GUI. At this point, you don't have drives mounted for either the Tivo or the CDROM. So, let's get the CDROM mounted. Take the MFS Live CD out (the os is loaded in ram) and place the CD with your kernel and tivo patches in the CD drive.

The CDROM mounting was an issue for me. I expected to be able to:
mount /dev/cdrom /cdrom
This didn't work. The /dev/cdrom is a link to the /dev/hdb device which was NOT my CDROM. My CDROM was actually device /dev/SR0 which didn't exist in the /dev directory. I corrrected this by using the /sbin/mkdev -s command. This created a lot of new devices in the /dev directory including /dev/sr0. I was then able to:
mount /dev/sr0 /cdrom
This gave me access to my cdrom. I believe a SATA CD/DVD drive will become SR0 rather than the default of HDB.

So, next I wanted to mount one of my TIVOHD partitions but didn't know which device the Tivo drive was being mapped to. In order to determine this, I did the following command:
cat /proc/partitions

Based on the partition sizes and numbers -- I was able to determine my TivoHD was being locally mapped to /dev/sdd. But sdd had 15 partitions -- sdd1-sdd15. This is why I printed off the partition map from WINMFS earlier. There are 2 possible root partitions -- #4 and #7. To see which is the active partition -- use the command bootpage -p /dev/sdd. This yielded HDA4 so I knew /dev/sdd4 was the active partition. Tivo uses the inactive partition for the software upgrade process. Since /dev/sdd4 is the active partion, /dev/sdd3 is the active Kernel partition.

Time to do some more mounts:
mount /dev/sdd4 /tivo
mkdir /tivovar
mount /dev/sdd9 /tivovar

I mounted partition 9 (/var) as /tivovar. I'm going to use this partition to store the files on CD and any backups.

cd /tivovar
mkdir hacks
cd hacks

So, let's copy over our CD files to this new directory.
cp /cdrom .

Time to unzip and untar the kernel.
bunzip2 Gen06-netopt-ext3.tar.bz2
tar -xvf Gen06-netopt-ext3

This should yield 2 files placed in a subdirectory:
bcmenet.o
vmlinux-Gen06-netopt-ext3.px

The vmlinux-Gen06-netopt-ext3.px is the kernel image.
Let's backup our existing kernel -- even though we should have it from our earlier WINMFS backup.

dd if=/dev/sdd3 of=kernel-backup

Now let's install the new kernel
dd if=vmlinux-Gen06-netopt-ext3.px of=/dev/sdd3

This kernel requires replacing the network driver -- the bcmenet.o file -- in order to function. This is located in the /platform/lib/modules directory but we've mounted the tivo drive as /tivo so this directory is /tivo/platform/lib/modules. Let's make a copy of the original and then replace it with the new module.

cd /tivo/platform/lib/modules
mv bcmenet.o bcmenet.original
cp /tivovar/hacks/Gen06-netopt-ext/bcmenet.o .

We've updated the kernel and replaced the network driver but there's one more thing we have to do -- remove the firewall (iptables).

cd /tivo/sbin
mv iptables iptables.original

vi iptables
#!/bin/bash
exit 0
:wq

chmod 755 iptables

The new kernel and network drivers should now work but it doesn't get us anywhere yet. We've not added the telnet or ftp services. Let's start with adding the tivotools to a directory called tivo-bin

mkdir /tivo-bin
cd /tivo-bin
tar -xvf /cdrom/tivotools.tar

Now that we have a /tivo-bin with a ftp server in it -- let's create a rc.sysinit.author file to launch these services. See http://dealdatabase.com/forum/showpost.php?p=271898&postcount=2

cd /tivo/etc/rc.d/
touch rc.sysinit.author

vi rc.sysinit.author
#!/bin/bash
export PATH=./:.:/bin:/sbin:/tvbin:/tivo-bin
export TIVO_ROOT=
export MFS_DEVICE=/dev/hda10
#serial bash... BE EXACT WITH THIS OR SERIAL WONT WORK!
/bin/bash</dev/ttyS1&>/dev/ttyS1&
#telnet
/sbin/tnlited 23 /bin/bash -login &
#ftp
/tivo-bin/tivoftpd

:wq

Save file and exit vi. Next we change the permissions for this file to rwx rx rx
chmod 755 rc.sysinit.author

The rest of the modifications can be done remotely so let's unmount our partitions.
umount /tivo
umount /tivovar
umount /cdrom
poweroff

You can now put the hard drive back in the Tivo and see if it still boots properly and whether thereis is telnet and ftp access to it. If everything was done correctly, we can now telnet to the tivo. Check the settings menu and discover it's IP address and then telnet from your PC to this address. There's no userid/password by default.

We created a /tivovar/hacks directory while in Linux so this should now be /var/hacks on the TivoHD.

cd /var/hacks
cp tvapppatches-11.0c.tcl tvapppatches.tcl
./tvapppatch.tcl

The above copies the patches file to the default name so no parameters are necessary when calling the tvapppatch.tcl tool. This tool supposedly patches the tivoapp with
"noencrypt"
"backdoors"
"30secskip"
"cci1"
"cci2"
"cci3"

I rebooted the tivo after this and things appear to be working. Shows which were being flagged copy protected are no longer being flagged. Older recordings are still working. I'm able to transfer and play files via the Tivo Desktop software.

I've not looked at trying to prevent software updates or using other software for faster transfers yet. I thought I'd try writing this up while it was still fresh in my memory and let people post where I went wrong or what I have yet to do.

dlfl
06-29-2009, 01:31 AM
Holy Crap! Thank you for this awesome writeup! Almost makes me feel like I could do it!

Now, after the next update walks over your hacks, how much of this has to be repeated? (I'm braced for the answer = "all of it".)

Also, if I'm understanding this post by cartouchbea (http://www.dealdatabase.com/forum/showpost.php?p=301799&postcount=8)correctly, doing the noencrpyt patch actually is not desirable if your primary interest is TTG rather than MRV (which is my case). Is that correct? In your procedure, how would you eliminate the noencrpyt patch but do the rest?

And I see three cci patches. Has that always been the case for cci, or do they do different things?

Again, thanks for this major effort!

mlcarson
06-29-2009, 03:25 AM
I'm a newb -- not pretending to be an expert. Just documented what I did last night as best I could on my first attempt at a Tivo Hack after pulling the knowledge from the threads on this board. The results so far are what I wanted. Things are not getting flagged copy protected and are not encrypted after transferring with Tivo Desktop. Tivo Desktop brings over the files as .tivo and I can open them with Videoredo and save as normal mpeg without a reencode. I only have 1 Tivo so MRV is not what I'm after either -- TivoToGo is. The recordings I've transferred play fine so maybe they're still being encrypted and decrypted as part of the Tivo Desktop transfer or the no encrypt patch is no longer an issue. Tivo Desktop is version 2.7 (323086).

The CCI patch is just done by modifying tivoapp in 3 places -- it's not really 3 patches.

I'll probably read more about what has to be done to prevent an update via bootpage but assuming I did nothing and an update happened -- I don't believe the /var partition gets wiped out. So, worse case my files are all still there and I need a new tvapppatches for the new tivoapp software. It's just the hassle of moving the HD over to the PC again and being notified that an update happened before recording too much new stuff. So, I can mitigate the pain of moving the HD by preventing the update or alternatively putting the HD in an external case and swapping the internal and external SATA connections for ease of movement.

T_RJ
06-29-2009, 09:29 AM
You can do an in place hack/upgrade of the new software before you let the TiVo upgrade itself. Use this thread as a guide http://www.dealdatabase.com/forum/showthread.php?t=60195

jt1134
06-29-2009, 09:40 AM
#serial bash... BE EXACT WITH THIS OR SERIAL WONT WORK!
/bin/bash</dev/ttyS2&>/dev/ttyS2&

I find the warning ironic :p
Serial port is mapped to /dev/ttyS1 on S3 tivos


#fakecall
/tivo-bin/fakecall.tcl

SA tivos get their guide data from daily calls so it would be a good idea not to run fakecall.

dlfl
06-29-2009, 10:04 AM
You can do an in place hack/upgrade of the new software before you let the TiVo upgrade itself. Use this thread as a guide http://www.dealdatabase.com/forum/showthread.php?t=60195
hmmm... I looked at the linked thread and got lost. Can you spell out what you're talking about for us newbs?

For example, how do you control when you "let the TiVo upgrade itself"? Is this possible because you have already hacked it to NOT do upgrades? Or is there some reliable notification system that tells you an upgrade has been TiVo-pushed into one of the two partition groups but has not yet been activated, so you can hack it before it gets activated? (Or what?).

Being able to handle future upgrades "in place" is obviously a major attraction.

dlfl
06-29-2009, 10:08 AM
I find the warning ironic :p
Serial port is mapped to /dev/ttyS1 on S3 tivos

SA tivos get their guide data from daily calls so it would be a good idea not to run fakecall.
Do either of these comments apply to TiVo HD models? There is some confusion because both S3 and HD models are classed as S3. And I don't know what an SA model is -- but I assume it isn't an S3 (or HD).

jt1134
06-29-2009, 10:22 AM
my comments apply to both the tivohd and original s3

sa == standalone ; ie: not a directv combo box

dlfl
06-29-2009, 10:37 AM
my comments apply to both the tivohd and original s3

sa == standalone ; ie: not a directv combo box
OK, what is "ironic" about mlcarlson's statement?:


/bin/bash</dev/ttyS2&>/dev/ttyS2&

Are you saying it's wrong and should use ttyS1 instead?

mlcarson
06-29-2009, 11:23 AM
It's probably wrong. This was taken from an old thread on different hardware (word for word) which is why it's difficult to get the proper instructions when you're just starting. I don't have console output yet on my TivoHD -- no parts just sitting around which will work. The bootpage stuff I was looking into made me think it should be port 1 rather than port 2 though. Thanks for pointing it out.

Jamie
06-29-2009, 11:57 AM
/dev/ttyDSS should always work, and is a link to the correct ttyS# device.

Note that getting serial port access on a tivohd takes some hardware work too. There's a thread about it here (http://www.dealdatabase.com/forum/showthread.php?t=56384&page=2).

dlfl
06-29-2009, 12:17 PM
/dev/ttyDSS should always work, and is a link to the correct ttyS# device.

Note that getting serial port access on a tivohd takes some hardware work too. There's a thread about it here (http://www.dealdatabase.com/forum/showthread.php?t=56384&page=2).
Does one have to have serial port access on the HD to (in-place) hack it? Isn't there a way to use the ethernet port and telnet client? (I did look at the linked thread but it didn't help me.)

Jamie
06-29-2009, 12:18 PM
Does one have to have serial port access on the HD to (in-place) hack it? Isn't there a way to use the ethernet port and telnet client? (I did look at the linked thread but it didn't help me.)You can get by in a pinch without serial port access. The main issue is that if you have problems getting networking to work, you're flying completely blind without serial port access. Also, if you have serial port access and have set a PROM password, you can often repair problems without needing to pull the drive. So it is highly recommended.

PlainBill
06-29-2009, 02:31 PM
hmmm... I looked at the linked thread and got lost. Can you spell out what you're talking about for us newbs?

For example, how do you control when you "let the TiVo upgrade itself"? Is this possible because you have already hacked it to NOT do upgrades? Or is there some reliable notification system that tells you an upgrade has been TiVo-pushed into one of the two partition groups but has not yet been activated, so you can hack it before it gets activated? (Or what?).

Being able to handle future upgrades "in place" is obviously a major attraction.

By using bootpage to add upgradesoftware=false to the boot parameters you can block installation of software upgrades. The files are downloaded and saved, but not installed. Once hacks are available for the new software, it is a trivial task to telnet in, make two changes to the upgrade script, and install the upgrade into the alternate partition set. (One of the changes blocks the automatic reboot.)

At that point the new kernel is overwritten with the existing custom kernel, and the appropriate files are transferred to the new root partition. A reboot, and you are running the latest version of software. No need to pull the drive.

Under normal circumstances, using the serial port is unnecessary IF the network is working properly. Networking problems are notoriously hard to troubleshoot. I compare attempting this without a serial port to searching for a black cat in a dark room - when the cat is hiding in the closet in the next room.

mlcarson, good job. I believe the iptables patch you used is obsolete, there is a simpler one.

PlainBill

ScanMan
06-29-2009, 03:06 PM
<snip>I believe the iptables patch you used is obsolete, there is a simpler one.Just to clarify, the "exit 0" iptables fix is required for custom (i.e., replace_initrd) kernels. The iptables flush won't work. But hey don't take my word for it; here is a quote from the custom kernel thread (http://www.dealdatabase.com/forum/showthread.php?t=54047).

All kernels are compiled with ext3 built in, CONFIG_NETFILTER off, and CONFIG_NET_FAST_TCP on. You will want to replace /sbin/iptables, as described here if you use these kernels. Otherwise, you might see crashes when the tivo software tries to load iptable rules.

dlfl
06-29-2009, 05:28 PM
By using bootpage to add upgradesoftware=false to the boot parameters you can block installation of software upgrades. The files are downloaded and saved, but not installed. .........PlainBill
Thanks PB.

What does "using bootpage" mean. Is bootpage one of the utilities? Which package? (I know there is a bootpage in the software.)

dlfl
06-29-2009, 05:31 PM
Just to clarify, the "exit 0" iptables fix is required for custom (i.e., replace_initrd) kernels. The iptables flush won't work. But hey don't take my word for it; here is a quote from the custom kernel thread (http://www.dealdatabase.com/forum/showthread.php?t=54047).
Again I tried to follow the linked thread chain without learning much. Does your statement mean that the "exit 0" fix WAS correct as used by mlcarson (since he used a modified kernel)? Or what?

ScanMan
06-29-2009, 07:57 PM
Again I tried to follow the linked thread chain without learning much. Does your statement mean that the "exit 0" fix WAS correct as used by mlcarson (since he used a modified kernel)? Or what?
Yes the "exit 0" fix is correct because he used a custom kernel. The "exit 0" fix is also required if you neuter the stock kernel with the 'replace_initrd' utility.

bootpage is a binary native on the tivo as well as the MFSLive CD.

bootpage -p /dev/sddwould print out the current parameters using the device the OP gave above. Typically you would modify it as such:

bootpage -P "root=/dev/hda7 dsscon=true console=1,115200 upgradesoftware=false" -C /dev/sdd That string of parameters assumes root is on the 7th partition; enables boot messages on the serial port and prevents automatic tivo software upgrades. This again assumes being done on the PC side (hence /dev/sdd) the hard drive is always "seen" on the tivo side as /dev/hda. Observe case sensitivity.

mlcarson
06-29-2009, 08:41 PM
Edited original post to map console to S1 and deleted fakecall.


I find the warning ironic :p
Serial port is mapped to /dev/ttyS1 on S3 tivos

SA tivos get their guide data from daily calls so it would be a good idea not to run fakecall.

dlfl
06-30-2009, 02:52 AM
Thanks guys. Chunk by chunk I'm building confidence I can do this (with a lot of help like you're giving).

mlcarson, early in your first post you say:


While in MFSLive, I printed a copy of the MFSINFO Partition maps (15 paritions).

But I wonder if you meant WinMFS instead of MFSLive, since you don't download the MFSLive disk until later in the post (?).

Also, if I don't want the noencrypt patch, is it obvious what to change or delete in the tvapppatches.tcl file? (I would like my TTG files to be the same format as with an unhacked TiVo -- my workflow is all set up to handle the decryption by loading the files into VideoReDo.)

mlcarson
06-30-2009, 03:21 AM
Yep -- I did mean that. Sorry for the confusion. Will edit this.




mlcarson, early in your first post you say:



But I wonder if you meant WinMFS instead of MFSLive, since you don't download the MFSLive disk until later in the post (?).

Also, if I don't want the noencrypt patch, is it obvious what to change or delete in the tvapppatches.tcl file? (I would like my TTG files to be the same format as with an unhacked TiVo -- my workflow is all set up to handle the decryption by loading the files into VideoReDo.)

dlfl
06-30-2009, 04:07 AM
...........Also, if I don't want the noencrypt patch, is it obvious what to change or delete in the tvapppatches.tcl file? (I would like my TTG files to be the same format as with an unhacked TiVo -- my workflow is all set up to handle the decryption by loading the files into VideoReDo.)

I ***think*** I've answered my own question here. I downloaded the tvapppatches-11.0c.tcl file and see this in it:



array set patch_11.0c {
0x005d3a14 "104000aa 100000aa"
0x00773b38 "00008021 24100001"
0x00b92be4 "14400026 10400026"
0x00656e40 "30b000ff 00008021"
0x00656e64 "00e08821 24110000"
0x0117e020 "30b000ff 00008021"
}

array set desc_11.0c {
0x005d3a14 "noencrypt"
0x00773b38 "backdoors"
0x00b92be4 "30secskip"
0x00656e40 "cci1"
0x00656e64 "cci2"
0x0117e020 "cci3"
}

I think if I don't want the "noencrypt" patch I just delete the two lines that start with that address (0x005d3a14). Will that do it?

ScanMan
06-30-2009, 08:29 AM
<snip>
I think if I don't want the "noencrypt" patch I just delete the two lines that start with that address (0x005d3a14). Will that do it?
Yes, exactly; just delete those two lines and run the patch on your tivo via telnet or serial.

dlfl
06-30-2009, 11:23 AM
When you telnet in and run tvapppatch.tcl, I assume the TCL interpreter must be present on the TiVo HDD, correct?

Has this been accomplished by the mlcarson sequence, or is it there to begin with?

I played with a Win32 version of TCL/Tk about 8 years ago -- liked it.

ScanMan
06-30-2009, 11:57 AM
When you telnet in and run tvapppatch.tcl, I assume the TCL interpreter must be present on the TiVo HDD, correct?Tivo supports TCL natively. The "tivosh" which is a symlink to the tivoapp binary, is a native TCL interpreter.

dlfl
06-30-2009, 12:47 PM
Tivo supports TCL natively. The "tivosh" which is a symlink to the tivoapp binary, is a native TCL interpreter.
So..... Is some of the tivo software actually (text) TCL source code ? I would be surprised but it sure would simplify hacking I would think.

jt1134
06-30-2009, 12:58 PM
the tivo is full of tcl scripts and shell scripts. much can be learned by simply reading thru these scripts

mlcarson
07-04-2009, 08:29 AM
Wow -- I must have bad timing. Was planning on experimenting more with the Tivo this weekend and it's already updated itself from 11.0c to 11.0d wiping out last week's hack.

lrhorer
07-04-2009, 01:49 PM
This post (http://dealdatabase.com/forum/showthread.php?p=297738#post297738) may be of some help. It's a little example script similar to the ones I use to hack my TiVos. It is not polished and does not involve any clever scripting. It is not necessarily intended for actual use by TiVo enthusiasts - although it could be, but rather as an illustration of the basic methods one may employ to hack an S3 TiVo.

After significant consideration, especially in light of the fact the hacks must be renewed every few months, my preferred method of handling the hacks is to create a Linux boot partition on the system used to hack the TiVos. Several of my systems run Linux almost exclusively in the first place, so creating a hacking environment for them is extremely simple. The machine I use most often to hack the TiVos, however, primarily boots Windows. Thus, on that machine, I took 100G of unused space (10G or so is more than plenty, actually) and loaded the Debian "Lenny" distro of Linux on the machine, creating a Grubb multi-boot system (which is the default). Now whenever I need to hack a TiVo, I don't have to scramble to find a CD or download the latest version of MFS_Live, or whatever. Instead, I boot directly into Linux from the hard drive, where I have not only all the binaries and scripts produced by members of the hacking community, but also scripts I have written and customized myself, similar to the one above. Now it takes me less than 5 minutes to hack a TiVo - quite literally less time than it takes to boot the TiVo after I have completed the hacks. If I have problem, questions, or issues, I can go online without having to leave the hacking environment, and since the patch values are usually posted on the forum somewhere, I can simply fire up the browser and then cut-and-paste from the browser to apply the patches. The Linux desktop environment also offers a number of advantages over the live CD environment, including hot-plugging, access to the full range of attached peripherals, and full network connectivity both to the internet and to the servers and other workstations on the LAN.

I also find it difficult to remember all the commands and switches when I only hack the TiVos once every three months or so. Although it is certainly possible to edit the contents of an .iso file to add personalized scripts or text notes, it's a bit of a pain, and any update to the boot CD by the hackers requires one to edit the new .iso to meet one's needs, or do without customization. With a desktop implementation, updating the OS can be completely asynchronous from changes to the utilities themselves, and downloading and implementing the changes to the utilities when need be is simple.

Finally, I really enjoy the fact I can set up the system to deliver precisely the hacks I want without any extra trouble more or less at the touch of a button, as it were. In my case, I implement TiVoWebPlus, NoCSO, TyTool (specifically tserver), telnet, ftp, busybox, several aliases, and a few scripts to do things like set the root filesystem to read-only / read-write, and so forth. I simply keep a mirror of the files I want from /etc and /var/hack in the appropriate directories on the desktop machine. I edit, add, or delete files as I see fit, and then simply tar the entire structure to a file on the desktop machine. When I mount the TiVo drive, I simply untar the file onto the mounted partition, and all the hacks other than the kernel neutering and the patches to tivoapp are done in a flash. If I need to do any tweaking on the TiVo, I can perform it there and then simply ftp the updates back to the desktop system to make them "permanent".

Now management of the hacked TiVos has gone from being a bit tedious to being a breeze. Rather than re-inventing the wheel every time, now I just rotate the tires and fix an occasional flat from time to time.

mlcarson
07-07-2009, 07:56 PM
Just a quick followup on this.... I did create a VMWare virtual machine and was able to use this rather than directly boot off the MFSLive CDROM. There's probably a better way of doing this but I simply mapped the CDROM to the downloadable MFSLive Linux ISO image. I then mapped a virtual hard disk as IDE 0:0 to use as a repository for various utilities/files. The Tivo HD I mapped as physical disk on another IDE channel pointing to the Tivo SATA disk. When I started the virtual machine, I was able to mount the Tivo partitions from the drive just like I was able to via the boot cd. The only real differences were that the Tivo HD and the CDROM were mapped to IDE devices rather than SATA devices and it allowed me to work on the Tivo while still having Windows up.

I'm not sure how to create a real Linux installation off from the MFSLive Linux boot disk. It might be useful to have a full blown Linux VM rather than just the Live CD. Are there instructions out there anywhere for simply modifying a standard Linux build to make Linux aware of Tivo partitions. Sorry -- not really a Linux guy. Irhorer's reply mentioned he's doing this and is kind of where I want to be but all within VMWare.


There may be a way of using VMWare to boot off the CD ISO and to point the virtual machine at the physical SATA drive connection so you can have Windows up at the same time -- I may look into this later.

jt1134
07-07-2009, 08:39 PM
Are there instructions out there anywhere for simply modifying a standard Linux build to make Linux aware of Tivo partitions.
you could patch and recompile your linux kernel, or take the easy way out and just use tivopart (http://www.dealdatabase.com/forum/showthread.php?t=25219).

lrhorer
07-08-2009, 11:26 PM
Just a quick followup on this.... I did create a VMWare virtual machine and was able to use this rather than directly boot off the MFSLive CDROM. There's probably a better way of doing this but I simply mapped the CDROM to the downloadable MFSLive Linux ISO image. I then mapped a virtual hard disk as IDE 0:0 to use as a repository for various utilities/files. The Tivo HD I mapped as physical disk on another IDE channel pointing to the Tivo SATA disk. When I started the virtual machine, I was able to mount the Tivo partitions from the drive just like I was able to via the boot cd. The only real differences were that the Tivo HD and the CDROM were mapped to IDE devices rather than SATA devices and it allowed me to work on the Tivo while still having Windows up.
That certainly works. You can do the same thing with an ordinary Linux desktop environment, as well. The advantage of the desktop environment, as I mentioned, is full access to all network utilities and peripherals, plus access to GUI based applications such as a web browser, GUI based text editors, etc.


I'm not sure how to create a real Linux installation off from the MFSLive Linux boot disk.
Well, it's certainly possible, but hardly worth the trouble. It's much easier just to create a Linux VM from whatever distro of Linux suits your fancy (I happen to like Debian) and add the few proprietary utilities and TiVo files required for hacking the TiVo.


It might be useful to have a full blown Linux VM rather than just the Live CD. Are there instructions out there anywhere for simply modifying a standard Linux build to make Linux aware of Tivo partitions.
As jt1134 mentioned, tivopart (http://www.dealdatabase.com/forum/showthread.php?t=25219) is a utility which, among other things, does just this very thing. If you will look at the script I posted, about 50 lines down you will see some lines that say:


# Scan the TiVo partitions to make them mountable
/hack/tivopart r $dspec

This runs the tivopart routine with the "r" switch (r = rescan) on the target $dspec, which is probably something like /dev/sdb. If there is a valid Tivo drive at $dspec, tivopart scans it and adds the partitions to the drive lists. After that partitions 4, 7, and 9 can be mounted just like any other Linux partition. As you can see in the following code, I do just that after running tivopart:


echo Mounting Drives...
mount $rootdrv /tivo
mount $vardrv /tivo/var

Typically, $rootdrv is something like /dev/sdb4 or /dev/sdb7 and $vardrv is something like /dev/sdb9. The examples wind up with the entire TiVo structure (other than the kernel) in the /tivo directory. Once done, the user can untar the previously prepared tarball containing the software and pertinent files from /etc, /var, /utils, /tivobin, and so forth, from the hacked Tivo image to the virgin image under /tivo/etc, /tivo/var, /tivo/utils, etc. After that, all that's left is patching tivoapp and either neutering the new kernel or copying over a custom kernel.


Sorry -- not really a Linux guy. Irhorer's reply mentioned he's doing this
That's Lrhorer, not Irhorer, if you please.


and is kind of where I want to be but all within VMWare.
Yeah, that sounds like a perfectly viable solution. VMWare can most certainly create a Linux VM. For my personal tastes, I'm just as happy simply booting into Linux, but there's certainly nothing whatsoever wrong with running a VMWare Linux session.

dlfl
07-18-2009, 10:32 AM
Am I correct that the only change needed in mlcarlson's procedure (first post of this thread) for the new 11.0d software is to use the new tivoapp patches given in this post (http://www.dealdatabase.com/forum/showpost.php?p=303739&postcount=2)?

ScanMan
07-18-2009, 12:03 PM
Am I correct that the only change needed in mlcarlson's procedure (first post of this thread) for the new 11.0d software is to use the new tivoapp patches given in this post (http://www.dealdatabase.com/forum/showpost.php?p=303739&postcount=2)?Yes, to make it easier I posted an 11.0d "tvapppatches" in the support thread. Good luck!

Richard Berg
08-04-2009, 01:56 AM
Great summary! I have only passing familiarity with Unix but I was able to hack my Tivo in just a few minutes using this post as a guide. Some corrections:


There may be a way of using VMWare to boot off the CD ISO and to point the virtual machine at the physical SATA drive connection so you can have Windows up at the same time -- I may look into this later.
As noted later in the thread, this is quite simple. However, VMWare Server 2.x does not support raw hard drive access. Unfortunately I only learned this the hard way after downloading & installing the whole thing. You can use a 1.x version of VMWare Server, a copy of VMWare Workstation ($$), or Microsoft Hyper-V (part of Win2008). I cut my losses and just switched over to my laptop.


Next, we need to download the various tools we'll need and burn them to a second CD. ... I believe the above files are the only ones I needed to burn to CD.
Just to save everyone some heartache: yes, those files are more than enough. I also read through all of the linked threads to ensure the "best" options were chosen. NetOpt is a nice custom kernel that only needs minor additional tweaking (provided below). TivoTools doesn't have a version number, but the attachment link is current as of this writing. TivoPatch 1.7 is indeed the latest. The only difference is that you need a 11.0d patch script, not 11.0c. Search the forum and you'll find it. No sense linking it when 11.0e will be out before you know it.


/sbin/mkdev -s
This command was a godsend. The rest of the hacking proceduring is fairly trivial and probably would've only taken a few extra hours in the absence of a guide, but it's extremely non-obvious (to me) that Linux would fail to detect some storage devices until running an extra command.

[b]However[/i], it has a typo. The actual command is 'mdev.' You shouldn't need to prepend /sbin/ as it's in your PATH.



I believe a SATA CD/DVD drive will become SR0 rather than the default of HDB.
I used my USB digital camera for storage since it was conveniently lying around. It showed up as SDx where x varied every time I plugged it in (even within the same session).

After running 'mdev -s' you should be able to identify your flash or optical drive quickly using 'cat /proc/partitions'. Use [TAB] completion, of course.


Since /dev/sdd4 is the active partion, /dev/sdd3 is the active Kernel partition.
This confused me. Short version: there are two pairs of kernel + boot partitions, 3+4 and 6+7. Once you identify the active boot partition then you can be assured the active kernel partition is (boot-1).



mkdir /tivovar
mount /dev/sdd9 /tivovar

I mounted partition 9 (/var) as /tivovar. I'm going to use this partition to store the files on CD and any backups.

This partition IS hard coded as far as I know. Unless you hear otherwise you can simply assume that partition 9 is the right one for your S3. Still doesn't hurt to recheck /proc/partitions and see what appears in /tivovar after you mount.



Time to unzip and untar the kernel.
bunzip2 Gen06-netopt-ext3.tar.bz2

I got a CRC error here. Surprise surprise, flash drives aren't the pinnacle of reliability. Recopied and then it worked. If this happens to you, don't blindly proceed, fix it!



cd /tivo/sbin
mv iptables iptables.original

vi iptables
#!/bin/bash
exit 0
:wq

chmod 755 iptables

If you're not familiar with Unix, this step probably confused the heck out of you. What we're doing here is:
- back up the existing iptables executable (using "move" - there's no separate rename command)
- create a new iptables that's actually a Bash script which simply exits w/o doing anything
- marking the script executable (yes, text files can be executable) for the root user

The VI part in the middle requires rudimentary knowledge of this rather unusual text editor. Crash Course in VI (http://homepage.mac.com/kelleherk/iblog/C1837526061/E765091708/index.html)

Contrary to what a couple posts said, this is necessary. Read the link in the OP describing the custom NetOpt kernel.



mkdir /tivo-bin
cd /tivo-bin
[...snip...]

I'm pretty sure this will not work. The root / exists only in the RAM of this MFSLive session. You're not writing anything to disk here. Being a newb I checked /proc/mounts and 'mount -l' to be sure. Decided to use /tivo/tivo-bin instead of /tivo-bin throughout this section and it worked perfectly. /tivovar/tivo-bin should work as well.



umount /tivo
umount /tivovar
umount /cdrom
poweroff

Again, I would scan 'mount -l' before powering off. Never know what drives you might have left lingering as you follow 7 different guides scattered across the forum...


bootpage -P "root=/dev/hda7 dsscon=true console=1,115200 upgradesoftware=false" -C /dev/sdd

That string of parameters assumes root is on the 7th partition; enables boot messages on the serial port and prevents automatic tivo software upgrades. This again assumes being done on the PC side (hence /dev/sdd) the hard drive is always "seen" on the tivo side as /dev/hda. Observe case sensitivity.
One additional wrinkle: if running this on the Tivo, the -C parameter will not be recognized. You can either specify /dev/hda without the -C, or omit it entirely.

valley_nomad
08-23-2009, 04:58 PM
A newbie question: I noticed that the stuff from tivotools were put into /tivo-bin. Is it better to put them in /var/hacks/bin (and make change in rc.sysinit.author accordingly)? I haven't done my hack yet so I don't know if /tivo-bin will get erased during sw upgrade. But at least in this way I have only one place to maintain those executables.

jt1134
08-23-2009, 10:08 PM
doesn't matter where you put your bins, you can put them in /poop so long as you set the PATH correctly

when a sw update occurs, the root and kernel partitions are swapped, nothing is actually overwritten

if you keep your hacks in root, then you'll need to copy them to the new root after an update

/var isn't changed during a sw update, so if you keep stuff there you don't need to do any copying, but you risk having your hacks wiped out if the tivo ever decides to purge var

valley_nomad
08-24-2009, 01:02 AM
array set patch_11.0c {
0x005d3a14 "104000aa 100000aa"
0x00773b38 "00008021 24100001"
0x00b92be4 "14400026 10400026"
0x00656e40 "30b000ff 00008021"
0x00656e64 "00e08821 24110000"
0x0117e020 "30b000ff 00008021"
}

array set desc_11.0c {
0x005d3a14 "noencrypt"
0x00773b38 "backdoors"
0x00b92be4 "30secskip"
0x00656e40 "cci1"
0x00656e64 "cci2"
0x0117e020 "cci3"
}

.....

I understand the benefit of doing noencrypt and cciX. But I am not aware of what we can actually have via 30secskip and bacldoors hacks. I believe now my TivoHD's 30secskip feature is already persistent once it is set via that key sequence; and I also couldn't find what "backdoors" can bring. Can anyone shed some lights on it?

valley_nomad
08-24-2009, 08:04 AM
This is my personal experience with hacking the TivoHD ....

.... We've not added the telnet or ftp services. Let's start with adding the tivotools to a directory called tivo-bin

mkdir /tivo-bin
cd /tivo-bin
tar -xvf /cdrom/tivotools.tar

.....
.

When I reached to this point, the tar command returns the error: invalid number ' 5566 '

What did I do wrong?

Is it true that I actually need only tivoftpd here instead of other stuff?

valley_nomad
08-27-2009, 02:44 AM
So it is clear that the step in the original post is wrong. The tivotools.tar can not be untared with MFSLive tar command. That may be because it can not handle the symbolic links in tivotools.tar.

WinRAR will be able to untar tivotools.tar. But it will not recreate those symbolic links. Instead it just makes a copy of busybox for each link. So you will end up with getting more than 100 MB stuff from tivotools.tar ;-)

The correct way is to get tivoftpd from tivotools.tar using WinRAR or other similar utility on PC. Then put both tivotools.tar and tivoftpd into /tivo/tivo-bin. After booting Tivo box with added rc.sysinit.author, telnet into Tivo and do the following (text in red):

hash-2.02# mount -o remount,rw /
hash-2.02# cd /tivo-bin
hash-2.02# cpio -i -H tar < tivotools.tar
cpio: tivoftpd not reated: newer or same age wersion exists
12779 blocks
hash-2.02# mount -o remount,ro /

Using ls you should see that most of commands are links to busybox.

Some commands from tivotools are already available in Tivo HD, such as ls. When being called outside /tivo-bin, those commands under other dirs will be used due to the way PATH is set in rc.sysinit.author.

One more note on the experience of my 1st attempt: There was a scary moment when I booted the box first time. It stayed a bit longer than usual on that "just a few minutes more" screen before showed the grey screen asking me to press the tivo button to start. I pushed the button, but there was no that video clip, only a black screen! I pushed the tivo button again and saw the Tivo Central screen with black background :-( I clicked the Now Playing List and saw only the bar without any characters. I could move the bar up down on the blank screen, which made me belive my 200 hours HD recordings might be still intact. I turn to Watch Live TV and it showed me a big spining wheel and message "getting channel info". I also tried a coupe of other menu screens and found they were pretty much all broken. I almost decided to revert the whole thing. But with a hunch, I booted the box again... And it worked :-) Is it normal to boot twice?

My new kernel is Gen06-netopt-ext3.

ziggynikki
08-29-2009, 03:32 PM
I receiving error message "no write support. Markup file system as read only" when mounting sdd9

reltubman
11-17-2009, 01:03 AM
Yes, to make it easier I posted an 11.0d "tvapppatches" in the support thread. Good luck!

Hey guys -
I am a noob and I have my prom hacked and ready to go...I tried all of this once by following another thread and ended up with an unbootable Tivo - so first I am going to get it booting again tomorrow...but after that I am going to follow this thread and hope for better luck...

I have 11.0d so, where do I find the tvappatches for 11.0d...sorry for the noob question any help you can offer is awesome!

Thanks!

ScanMan
11-17-2009, 10:59 AM
I have 11.0d so, where do I find the tvappatches for 11.0d...sorry for the noob question any help you can offer is awesome!
You can use the tvapppatches here:
http://www.dealdatabase.com/forum/showpost.php?p=303789&postcount=27
You probably want to read the whole thread for usage, etc.

Or do it the 'dd' way like this:
http://www.dealdatabase.com/forum/showpost.php?p=303739&postcount=2

reltubman
11-17-2009, 11:41 AM
for the DD approach, do I just type each line in manually into the prompt, i.e.

echo -ne "\x10\x00\x00\xaa" | dd conv=notrunc of=tivoapp bs=1 seek=1915412

then press enter, and then the next line and enter?

ScanMan
11-17-2009, 12:25 PM
for the DD approach, do I just type each line in manually into the prompt, i.e.

echo -ne "\x10\x00\x00\xaa" | dd conv=notrunc of=tivoapp bs=1 seek=1915412

then press enter, and then the next line and enter?Yes, but you can't patch a running tivoapp. You need to do something like:

mount -o remount,rw /
cd /tvbin
cp tivoapp tivoapp.new
chmod 755 tivoapp.new
echo -ne "\x10\x00\x00\xaa" | dd conv=notrunc of=tivoapp.new bs=1 seek=1915412
<do rest of your 'dd' statements>
mv tivoapp tivoapp.orig
mv tivoapp.new tivoapp
restartIt's always good to keep an original copy in case something goes wrong. Be careful keeping too many copies as it takes up lots of space.

reltubman
11-17-2009, 04:33 PM
Yes, but you can't patch a running tivoapp. You need to do something like:

mount -o remount,rw /
cd /tvbin
cp tivoapp tivoapp.new
chmod 755 tivoapp.new
echo -ne "\x10\x00\x00\xaa" | dd conv=notrunc of=tivoapp.new bs=1 seek=1915412
<do rest of your 'dd' statements>
mv tivoapp tivoapp.orig
mv tivoapp.new tivoapp
restartIt's always good to keep an original copy in case something goes wrong. Be careful keeping too many copies as it takes up lots of space.

Alternatively, I can just run through mlcarson's approach and use the 11d appatches...correct? By the way...I was able to get my TiVo working again...every thing seems good, I just need to wait for the box to update to the 11d version...there is no manual way to do that correct?

ScanMan
11-17-2009, 05:48 PM
Alternatively, I can just run through mlcarson's approach and use the 11d appatches...correct? By the way...I was able to get my TiVo working again...every thing seems good, I just need to wait for the box to update to the 11d version...there is no manual way to do that correct? yup I think I already said that; that would be the tvapppatch method which you would typically do in a telnet session after you boot into the hacked tivo.

You can try to download an update by repeatedly forcing tivo to call home.

reltubman
11-19-2009, 02:53 PM
OK, I followed the guide in the 1st post and now I have the tivo rebooted and I have telnet'd in but when I try to do the ./tvapppatches.tcl command I get a permission denied...am I doing something wrong, do I need to SU somehow? I am logging into telnet using > telnet 10.0.1.117 and I get the bash-2.02# prompt

Thanks!

reltubman
11-19-2009, 05:11 PM
OK, I followed the guide in the 1st post and now I have the tivo rebooted and I have telnet'd in but when I try to do the ./tvapppatches.tcl command I get a permission denied...am I doing something wrong, do I need to SU somehow? I am logging into telnet using > telnet 10.0.1.117 and I get the bash-2.02# prompt

Thanks!

Disregard - I patched it manually using the DD method...

garrubal
11-28-2009, 03:54 AM
The CDROM mounting was an issue for me. I expected to be able to:
mount /dev/cdrom /cdrom
This didn't work. The /dev/cdrom is a link to the /dev/hdb device which was NOT my CDROM. My CDROM was actually device /dev/SR0 which didn't exist in the /dev directory. I corrrected this by using the /sbin/mkdev -s command. This created a lot of new devices in the /dev directory including /dev/sr0. I was then able to:
mount /dev/sr0 /cdrom
This gave me access to my cdrom. I believe a SATA CD/DVD drive will become SR0 rather than the default of HDB.


I've followed the steps from the first post, up until the mounting of the CD-ROM.

The command /sbin/mkdev -s give me the following: -/bin/sh: /sbin/mkdev: not found.

I went to the /sbin directory, and I found "makedevs" and "mdev". "mkdev" was not in /sbin.

I tried the command /sbin/mdev -s and it looks like it worked. I compared the /dev directory before and after the operation using the ls command. However, now I'm stuck trying to identify which to select for the command mount /dev/??? /cdrom. sr0 does not appear under /dev.

I've tried the following with no success:
mount /dev/cdrom /cdrom
mount /dev/hdb /cdrom
mount /dev/sr0 /cdrom

EDIT: Problem solved. I did the command mount /dev/hda /cdrom and it worked.

EDIT: As a side note, I installed UBUNTU as an operating system on my computer as well. However, when I connected the Tivo hard drive, UBUNTU could see the hard drive, but it didn't really recognize it (something about SMART, but I can't remember at the moment). When I checked WinMFS, I noticed that some of the partitions were in EXT2 format. Since I had installed UBUNTU in EXT3 format, I reinstalled it in EXT2 format, but I had the same problem. I could try installing in EXT4 format, but I don't know if it would make a difference. As another user suggested, I could also try installing Debian Lenny instead of UBUNTU, but I don't know if that would make a difference.

garrubal

garrubal
11-28-2009, 09:48 PM
Sorry for the double post, but now I have a new problem.

I went through the entire procedure up until returning the tivo hard drive to the tivo. The tivo is now cycling in the welcome power up screen. I'll need to take out the hard drive and revert the changes. Hopefully it'll return to normal.

More disconcerting is that afterwards, I placed the original 160 GB hard drive that came with the tivo. Rather than cycling through the power up screen, it's just stuck at the power up screen.

I'm hoping the problems are just with the hard drives and not with the board.

I may need to get a third hard drive and see what happens.

ScanMan
11-29-2009, 10:56 AM
Sorry for the double post, but now I have a new problem.

I went through the entire procedure up until returning the tivo hard drive to the tivo. The tivo is now cycling in the welcome power up screen. I'll need to take out the hard drive and revert the changes. Hopefully it'll return to normal.

More disconcerting is that afterwards, I placed the original 160 GB hard drive that came with the tivo. Rather than cycling through the power up screen, it's just stuck at the power up screen.

I'm hoping the problems are just with the hard drives and not with the board.

I may need to get a third hard drive and see what happens.Reboot loops often occur from an iptables screwup. Capturing the boot messages at the console is recommended and often simplifies troubleshooting. You might be able to snarf it by mounting the /var (9th) partition and looking at /var/log/kernel but sometimes not; there is no substitute for viewing the in-flight boot messages.

garrubal
11-29-2009, 09:43 PM
Reboot loops often occur from an iptables screwup. Capturing the boot messages at the console is recommended and often simplifies troubleshooting. You might be able to snarf it by mounting the /var (9th) partition and looking at /var/log/kernel but sometimes not; there is no substitute for viewing the in-flight boot messages.

Thanks for the response. I'll have to give that a try.

On a side note, I was able to get a non-hacked tivo hard drive and the tivo works fine. Now it's back to trying to fix those iptables on the other hard drive. It was a huge relief that I didn't screw up the tivo itself. :D

PlainBill
11-30-2009, 11:44 AM
Capturing the serial console. (http://www.dealdatabase.com/forum/showthread.php?p=234467#post234467)

PlainBill

bhduifhds
11-30-2009, 02:00 PM
On a side note, I was able to get a non-hacked tivo hard drive and the tivo works fine. Now it's back to trying to fix those iptables on the other hard drive. It was a huge relief that I didn't screw up the tivo itself.

lockrob2000
12-17-2009, 04:29 PM
Please let me again reiterate...
WOW, and Holy Crap!

Now, if it were only easy. But, I think I'll print this whole thread up as a guide and work it through.
Thanks-

garrubal
12-17-2009, 04:39 PM
Please let me again reiterate...
WOW, and Holy Crap!

Now, if it were only easy. But, I think I'll print this whole thread up as a guide and work it through.
Thanks-

Make sure you read the first post and also Richard Berg's follow up.

I'm moving a lot slower than expected. I really need to set aside a few hours, as my first attempt was not successful. I suspect typos on my part.

garrubal
01-03-2010, 03:58 AM
cd /var/hacks
cp tvapppatches-11.0c.tcl tvapppatches.tcl
./tvapppatch.tcl


Is the above correct?

After typing /.tvapppatch.tcl I get "no such file or directory".
So I tried ./tvappatches.tcl, but I get "line 36 syntax error near unexpected token '}'

Thanks in advance for any help.

EDIT: Sorry, I didn't realize I needed to download two separate files. One is tvapppatches-11.0d.tcl and the other one is tvapppatch.tcl.

EDIT #2: Added the other .tcl file, rebooted, and now it works.

Newly recorded shows that used to be copy protected are now clear. Is there anything that can be done for the old shows that have already been flagged? Thanks.

Big kudos to mlcarson for putting together the initial post. Even with his help, I made quite a few errors which set me back. I'm not sure I would have figured everything out on my own, in terms of gathering all of the correct files. Thank you very much mlcarson, and also to all the posters who have responded to my noob questions.

garrubal
01-05-2010, 02:14 AM
I'm pretty sure this will not work. The root / exists only in the RAM of this MFSLive session. You're not writing anything to disk here. Being a newb I checked /proc/mounts and 'mount -l' to be sure. Decided to use /tivo/tivo-bin instead of /tivo-bin throughout this section and it worked perfectly. /tivovar/tivo-bin should work as well.




EDIT: The following occurs after accessing my tivo via telnet:

I think I used the /tivo/tivo-bin option to do the "tar -xvf /cdrom/tivotools.tar" command. However, I can't seem to find the /tivo-bin directory.

I was able to find the /var/hacks directory, so I can find the tivotools.tar file. I tried creating the tivo-bin directory in some areas, but it essentially told me it was a read-only area. So, I created the tivo-bin directory inside the /hacks directory just to test it. Then I tried to tar the tivotools.tar file, but the tar command wasn't recognized.

EDIT: I found the "cpio" command, and I was able to extract the files from tivotools.tar. It looks like I'll just have to take out the hard drive again and make things easy on myself. For example, the rc.sysinit.author file is read-only, so I can't seem to save the file after making changes to is using the "vi" provided by tivotools.

garrubal
01-08-2010, 03:18 PM
I've not looked at trying to prevent software updates or using other software for faster transfers yet. I thought I'd try writing this up while it was still fresh in my memory and let people post where I went wrong or what I have yet to do.

Software update prevention has been covered previously in this thread, so I won't rehash that.

But after reaching the point where I had telnet and ftp access, the issue of extraction came up. Although tivo to go is certainly an option, I was looking for something faster.

First, I got the mfs tools for tivo hd here. This has "tserver", which you will need for tytool: http://www.dealdatabase.com/forum/showpost.php?p=290822&postcount=10

Then I got TyTool, which is available here: http://www.dealdatabase.com/forum/showthread.php?t=47025

This page gives you some info on how to install TyTool:
http://www.weethet.nl/english/tivo_extract_videos.php

But I followed the steps only up to extraction.

Once I extracted a file, I used s3tots (S3 to transport stream (ts)).
http://dealdatabase.com/forum/showthread.php?t=57574

Additionally, there is a nice, simple graphical user interface for s3tots:
http://dealdatabase.com/forum/showthread.php?t=61940

That's as far as I got. I'm planning on using videoredo to edit out commercials. Since this is a transport stream file, I'm not sure it'll be a problem. I'll need to test it out.

Are there faster/better tools out there besides what I listed above? I looked at mfs_ftp, but after a few hours of searching, I couldn't make it work and gave up. TyTool is very nice, though.

Heinrich
06-09-2010, 04:53 PM
...deleted by author....

Heinrich
06-09-2010, 07:48 PM
...deleted by author..

Heinrich
06-10-2010, 09:39 AM
I'm IN! I can telnet in! However, when I type anything , even 'cd' , I get "command not recognized."

My guess is some sort of path statement issue (?)

FIXED --> I remember using Teraterm in 2003. "Dave's Telnet" was giving me "command not recognized" even when hitting enter. I tried Linux and Unix and VT-100 emulation. I gave up on Dave, even though I like the display better.

Heinrich
06-10-2010, 11:54 AM
Suffering !

The tvapppatch.tcl is warning me of "no such file or directory" even though I have tvapppatch.tcl and tvapppatches.tcl in the same folder. I transfered with both CD and ftp. I had to manually run the tivoftpd to get the tivo server up. tivo-bin is not part of my pathing, even though I see it in rc.sysinit.author ; I can't run vi or ls from the telnet prompt ... not sure where to start

GreenLego
07-19-2010, 11:29 PM
Great guide ! I've followed the instructions, however, I can not mount partition 9 for some reason. I can mount partition 4 (my active) just fine and can look around in it. So can I skip the mounting of partition 9 and do everything in partition 4, making sure to point all the scripts there instead or does the files need to be in partition 9?

Thank you.

Thinkdiff
07-20-2010, 02:06 AM
Great guide ! I've followed the instructions, however, I can not mount partition 9 for some reason. I can mount partition 4 (my active) just fine and can look around in it. So can I skip the mounting of partition 9 and do everything in partition 4, making sure to point all the scripts there instead or does the files need to be in partition 9?

Thank you.

If you just restored the drive from a truncated image, you won't have a /var partition yet (partition 9). You can just boot the tivo with the restored drive once (to the TiVo menu), and then follow the guide. Partition 9 will get formatted and populated on the first boot.

wouldrichest
07-20-2010, 07:09 PM
OK, what is "ironic" about mlcarlson's statement?:


/bin/bash</dev/ttyS2&>/dev/ttyS2&

Are you saying it's wrong and should use ttyS1 instead?

It's probably wrong. This was taken from an old thread on different hardware (word for word) which is why it's difficult to get the proper instructions when you're just starting. I don't have console output yet on my TivoHD -- no parts just sitting around which will work. The bootpage stuff I was looking into made me think it should be port 1 rather than port 2 though. Thanks for pointing it out.

Heartbreaker
01-22-2011, 03:22 PM
The CDROM mounting was an issue for me. I expected to be able to:
mount /dev/cdrom /cdrom
This didn't work. The /dev/cdrom is a link to the /dev/hdb device which was NOT my CDROM. My CDROM was actually device /dev/SR0 which didn't exist in the /dev directory. I corrrected this by using the /sbin/mkdev -s command. This created a lot of new devices in the /dev directory including /dev/sr0. I was then able to:
mount /dev/sr0 /cdrom
This gave me access to my cdrom. I believe a SATA CD/DVD drive will become SR0 rather than the default of HDB.

Ok super newbie here. Spent a week reading the entire forum so once I got my PROM mod Tivo back I wouldn't have any hiccups. But here I am stuck on the first step just trying to mount the CDRom. I have tried the command in the initial post, also tried /sbin/mdev -s. When I type mount /dev/sr0 /cdrom I get the following:

EXT4-fs: Update your userspace programs to mount using ext4
EXT4-fs: ext4dev backwards compatibility will go away by 2.6.31
GFS2: path_lookup on /dev/sr0 returned error -2
GFS2: gfs2 mount does not exist
mount: mounting /dev/sr0 on /cdrom failed: No such file or directory

What am I doing wrong?

EDIT: Moved patches to Flash drive. Unable to even mount any of the drives (Tivo drive is in an external storage case connected via USB).

mike_s
01-23-2011, 09:26 AM
What is the output of these four commands?


ls /cdrom
ls /dev/sr0
mount
dmesg | grep CD-ROM

Heartbreaker
01-23-2011, 04:13 PM
What is the output of these four commands?


ls /cdrom
[mfslive:/]#


ls /dev/sr0
ls: /dev/sr0: No such file or directory


mount
rootfs on / type rootfs (rw)
proc on /proc type proc (rw)
sysfs on /sys type sysfs (rw)
none on /dev/pts type devpts (rw,gid=5,mode=620)


dmesg | grep CD-ROM
Uniform CD-ROM driver Revision: 3.20


... hope this helps some.

ScanMan
01-23-2011, 05:31 PM
... hope this helps some.Meh, not so much...you need to examine the mfslive drive mappings at boot - first use Shift-PgUp to go back over the messages. Or
dmesg | morewill allow you page through using the Space bar. Since linux likes to prefix drive mappings with sd or hd (roughly SATA, IDE) use a little more precision:
dmesg | grep [h,s]dNow that reveals:
Installing knfsd (copyright (C) 1996 okir@monad.swb.de).
ide0: BM-DMA at 0x3080-0x3087, BIOS settings: hda:DMA, hdb:pio
ide1: BM-DMA at 0x3088-0x308f, BIOS settings: hdc:DMA, hdd:pio
hda: HTS421260H9AT00, ATA DISK drive
hdc: HL-DT-ST DVD-RW GWA-4082N, ATAPI CD/DVD-ROM drive
hda: max request size: 512KiB
hda: 117210240 sectors (60011 MB) w/1570KiB Cache, CHS=16383/255/63, UDMA(100)
hda: cache flushes supported
hda: hda1 hda2
hdc: ATAPI 24X DVD-ROM DVD-R CD-R/RW drive, 2048kB Cache, UDMA(33)
SCSI device sda: 125952 512-byte hdwr sectors (64 MB)
sda: Write Protect is off
sda: Mode Sense: 23 00 00 00
sda: assuming drive cache: write through
SCSI device sda: 125952 512-byte hdwr sectors (64 MB)
sda: Write Protect is off
sda: Mode Sense: 23 00 00 00
sda: assuming drive cache: write through
sda: sda1
sd 0:0:0:0: Attached scsi removable disk sda
Ah that looks familiar, /dev/hda is my hard drive and /dev/hdc is my cdrom and /dev/sda is my USB thumb drive. Now let's mount:
mount /dev/hdc /cdrom
mount /dev/sda1 /dos
mount
proc on /proc type proc (defaults)
sysfs on /sys type sysfs (defaults)
none on /dev/pts type devpts (gid=5,mode=620)
/dev/sda1 on /dos type msdos (0)
/dev/hdc on /cdrom type iso9660 (ro)
We should be off and running...

Heartbreaker
01-23-2011, 06:10 PM
We should be off and running...

Firstly, thanks for the information, ScanMan. Ok so when I went through the drive mappings, I saw hdc was indeed my DVDROM, sda is my external SATA Tivo drive, and sdb is my USB flash. But at each mount command I got messages that seem like errors.


mount /dev/hdc /cdrom I got the follwing:


EXT4-fs: Update your userspace programs to mount using ext4
EXT4-fs: ext4dev backwards compatibility will go away by 2.6.31
MINIX-fs: blocksize too small for device
UFS: failed to set blocksize
EFS: device does not support 512 byte blocks
attempt to access beyond end of device
hdc: rw=0, want=268435464, limit=67108864
attempt to access beyond end of device
hdc: rw=0, want=268435472, limit=67108864
attempt to access beyond end of device
hdc: rw=0, want=134217736, limit=67108864
attempt to access beyond end of device
hdc: rw=0, want=134217744, limit=67108864
UDF-fs: No VRS found
BeFS(hdc): No write support. Marking filesystem read-only
BeFS(hdc): invalid magic header
(977,0):ocfs2_fill_super:642 ERROR: superblock probe failed!
GFS2: gfs2 mount does not exist
mount: mounting /dev/hdc on /cdrom failed: No such file or directory

Any idea what this means?

ScanMan
01-23-2011, 06:45 PM
Any idea what this means?I assume you are using mfslive; you don't need to mkdev, the sd and hd devices are resident in the ramdisk. Try mounting read-only (-r). Also, you don't have to mount the cdrom - just copy whatever files you need to the thumb.

Heartbreaker
01-24-2011, 04:36 PM
I assume you are using mfslive; you don't need to mkdev, the sd and hd devices are resident in the ramdisk. Try mounting read-only (-r). Also, you don't have to mount the cdrom - just copy whatever files you need to the thumb.

Hi ScanMan, I am using the mfslive linux cd. Seems like every step there is an issue. After I
cd /tivovar
cd hacks I try to copy the files from my mounted flash drive (/dev/sdb) to the tivo drive using
cp /dev/sdb1, but unfortunately it does not copy the files off the flash. The closest it looks like I have had to having any success with the cp command is when I used it as follows:
cp -p /dev/sdb1 /tivovar/hacks/

Is there anything wrong with this? It's a bit frustrating being new to the whole UNIX world and trying to follow the step-by-step on the first post and none of the commands seem to work out right

ScanMan
01-24-2011, 04:47 PM
I'm not sure if you're leaving out steps but first you have to mount the device providing a directory mountpoint
mount /dev/sdb1 /dosThen you either want to list the files individually:

cp /dos/rc.sysinit.author /tivovar/hacksOr use a wildcard:

cp /dos/* /tivovar/hacksCheck out a man page for cp by googling 'man cp'

Heartbreaker
01-24-2011, 05:20 PM
...Check out a man page for cp by googling 'man cp'

Again, thank you for helping me with this. So step-by-step of what I am doing: 1) mount /dev/sdb1 /dos -- yields:
EXT4-fs: Update your userspace programs to mount using ext4
EXT4-fs: ext4dev backwards compatibility will go away by 2.6.31 Looks like a general message but thought I'd mention. 2) bootpage -p /dev/sda -- yields
HDA7 so 3) mount /dev/sda7 /tivo -- this yields:
EXT4-fs: Update your userspace programs to mount using ext4
EXT4-fs: ext4dev backwards compatibility will go away by 2.6.3
EXT4-fs: warning (device sda7): ext4_fill_super: extents feature not enabled on this filesystem, use tunefs.
4) mkdir /tivovar
5) mount /dev/sda9 /tivovar -- yields, again
EXT4-fs: Update your userspace programs to mount using ext4
EXT4-fs: ext4dev backwards compatibility will go away by 2.6.3
EXT4-fs: warning (device sda7): ext4_fill_super: extents feature not enabled on this filesystem, use tunefs.
6) cd /tivovar
7) mkdir hacks -- yields
mkdir: cannot create directory 'hacks': File exists
8) cd hacks
9) cp /dos/* /tivovar/hacks -- yields
cp: write error: No space left on device
cp: write error: No space left on device
cp: write error: No space left on device
cp: write error: No space left on device
cp: write error: No space left on device

Which puzzles me because my tivo drive is 1Tb and at start up it clearly says (1.00 TB/931GiB) ... so it recognizes I have 931 GB free so why would it say no space left on device?

Thinkdiff
01-24-2011, 06:09 PM
The var partition is only 128 or 256 MB by default, depending on the TiVo.

If you have over 256MB worth of files in your /dos directory, that would explain why you're running out of space.

To check disk usage:

df -h

Heartbreaker
01-24-2011, 06:12 PM
The var partition is only 128 or 256 MB by default, depending on the TiVo.

If you have over 256MB worth of files in your /dos directory, that would explain why you're running out of space.

To check disk usage:

df -h

Ok /dev/sda9 use is 100% so that explains it. df -h yields:


FILESYSTEM SIZE USED AVAIL. USE% Mounted On
/dev/sdb1 1.9G 4.3M 1.9G 0% /dos
/dev/sda7 247.9M 66.4M 168.7M 28% /tivo
/dev/sda9 247.9M 247.9M 0 100% /tivovar

Thanks for the code, BTW. Like I said complete newbie to UNIX. But now that I know the issue, what do I do? how do I copy over the files?

ScanMan
01-24-2011, 06:20 PM
I haven't seen that error message or warning before; I'm not sure if I'm using the latest mfslive. Try a couple of things, after you mount.
ls -l /tivovar
df -hThose should list the contents of your /tivovar directory and show disk usage on mounted devices.

Why do have 256MB of files to copy? Just copy things over individually - you shouldn't need much. Perhaps a kernel file, tivotools, an .author file, etc.

mike_s
01-24-2011, 06:53 PM
Again, thank you for helping me with this. So step-by-step of what I am doing: 1) mount /dev/sdb1 /dos -- yields...

Try

mount -t vfat /dev/sdb1 /dos

Heartbreaker
01-24-2011, 07:01 PM
Why do have 256MB of files to copy? Just copy things over individually - you shouldn't need much. Perhaps a kernel file, tivotools, an .author file, etc.

Honestly I have no idea. the files don't add up to that much but df -h shows that the /tivovar directory is completely 100% used... this is what came up with df -h:

FILESYSTEM SIZE USED AVAIL. USE% Mounted On
/dev/sdb1 1.9G 4.3M 1.9G 0% /dos
/dev/sda7 247.9M 66.4M 168.7M 28% /tivo
/dev/sda9 247.9M 247.9M 0 100% /tivovar

ScanMan
01-24-2011, 10:18 PM
You'll have to delete some files before you continue. I would delete the /hacks since you probably copied unnecessary stuff there. After a cd /tivovar issue:

rm -r ./hacksThis will recursively delete the entire /hacks directory; you'll have to recreate it.

FYI, tivo's /var partition routinely gets wiped upon boot for various reasons; many people put their hacks right on the root filesystem (in your case it appears 7th partition). Just be aware if all your eggs are in the /var basket you'll be pulling the drive if it gets wiped. Not that I'm trying to add another wrinkle to your "experience". :D

Heartbreaker
01-25-2011, 01:26 AM
You'll have to delete some files before you continue. I would delete the /hacks since you probably copied unnecessary stuff there. After a cd /tivovar issue:

rm -r ./hacksThis will recursively delete the entire /hacks directory; you'll have to recreate it.
This was a godsend. It worked and I was able to finally copy the files over --1000 thanks--. I don't know what unnecessary files there were but when I would ls hacks, it would yield /dev/sdb1. The


FYI, tivo's /var partition routinely gets wiped upon boot for various reasons; many people put their hacks right on the root filesystem (in your case it appears 7th partition). Just be aware if all your eggs are in the /var basket you'll be pulling the drive if it gets wiped. Not that I'm trying to add another wrinkle to your "experience". :D

LOL... so many wrinkles. At what point would it get wiped out? When I re-connect the hard drive to the Tivo unit?

Also, now I have gotten to where I am disabling the firewall (iptables). I was able to back up the existing iptables executable, but doing
vi iptables
#!/bin/bash
exit 0
:wq

chmod 755 iptables ...I got stuck again. How do you save & exit back to the command prompt from VI text editor? It's not really clear on this in the OP and goes on to adding tivotools.

Thinkdiff
01-25-2011, 03:42 AM
After you start typing in vi (by pressing the "i" key - insert) and finish typing what you want, press ESC to exit insert mode, then type ":wq" and hit enter. ":" signifies a command, "w" for write changes, "q" for quit.

Heartbreaker
01-25-2011, 03:44 AM
After you start typing in vi (by pressing the "i" key - insert) and finish typing what you want, press ESC to exit insert mode, then type ":wq" and hit enter. ":" signifies a command, "w" for write changes, "q" for quit.

thank you. So what is the "chmod 755 iptables" line for?

Thinkdiff
01-25-2011, 03:54 AM
"chmod 755 iptables" is another command you run after creating the file with vi. Basically it sets the permissions on the file you just created (iptables) so the TiVo can execute it.

Heartbreaker
01-25-2011, 07:08 PM
"chmod 755 iptables" is another command you run after creating the file with vi. Basically it sets the permissions on the file you just created (iptables) so the TiVo can execute it.


Ahh I see now. Now my question is regarding the original post. I can see now a lot of little things that are not mentioned which a seasoned vet like you and ScanMan would notice but a newbie like myself wouldn't be able to catch. so when I am in VI when you type #!/bin/bash, should that actually BE in the text for iptables. i.e. before you <esc> :wq the text should read as follows:

#!/bin/bash
exit 0 ... the reason I ask is because I am unable to move the cursor initially in VI and no text starts appearing until I am partially typing 'exit 0'
Also. when you are creating the rc.sysinit.author file, on the OP there's a note that says 'BE EXACT WITH THIS OR SERIAL WONT WORK' with the line
#serial bash... .. just to clarify, is it written just as above or does it mean replace #serial with your Tivo serial number?

my apologies if these seem like silly questions, I just want clarity and want this to work

Heartbreaker
01-25-2011, 08:24 PM
Nevermind. I answered my own question. In the final stretch (WOO HOO!)

and I was able to telnet into my Tivo. I'm in the final step:

cd /var/hacks
cp tvapppatches-11.0c.tcl tvapppatches.tcl
./tvapppatch.tcl

... but when I get to ./tvapppatch.tcl, I get en error:

bash: ./tvapppatch.tcl: No such file or directory


Any remedies?

Thinkdiff
01-25-2011, 09:07 PM
you can try:

chmod 755 tvapppatch.tcl
./tvapppatch.tcl

but sometimes that doesn't work, and you need to call tivosh directly:

tivosh tvapppatch.tcl

Heartbreaker
01-27-2011, 03:27 AM
Looks like it all worked out. Only issue I see is that I used to be able to watch Netflix from my Tivo and now the option is gone. Any way to get that back?

Also, if shows previously recorded shows and they were flagged on your HD, will they still be flagged after all this?

Thinkdiff
01-27-2011, 03:39 AM
Already answered via PM, but I'll post here for everybody to see:

The "nopromos" patch disables Video on Demand. You'll have to revert that patch location to get Netflix back.

Are you trying to remove just the CCI byte or encryption? Already encrypted shows cannot currently be decrypted. I'm not sure about removing the CCI byte. It might be possible.

Heartbreaker
01-27-2011, 03:47 AM
Already answered via PM, but I'll post here for everybody to see:

The "nopromos" patch disables Video on Demand. You'll have to revert that patch location to get Netflix back.

How is this done? Would I be able to do this via telnet?

Thinkdiff
01-27-2011, 03:55 AM
Yes. The nopromos patch for 11.0j is:

0x00867e9c "0d2939a5 00000000" //nopromos

So you have to change the value of tivoapp at location 0x867e9c back to 0d2939a5. That can be done with the following command:

echo -ne "\x0d\x29\x39\xa5" | dd conv=notrunc of=tivoapp bs=1 seek=4619932

So it'd go something like this:


mount -o remount,rw /
cd /tvbin
mv tivoapp tivoapp.nopromos
cp tivoapp.nopromos tivoapp
echo -ne "\x0d\x29\x39\xa5" | dd conv=notrunc of=tivoapp bs=1 seek=4619932
mount -o remount,ro /
reboot


This is for 11.0j

rngbld
02-07-2011, 01:35 AM
hello folks

I am in the directory /tivo/platform/lib/modules/#
and I am trying to execute command cp tivovar/hacks/Gen06-netopt-ext3/bcmenet.o

It gives me an error
Busybox v1.13.2 multi-call binary
usage: cp [option]... source dest

copy source to dest, or multiple soruces to directory

options:
-a
-d,-p
-H,-L
etc

any suggestions?


BTW when I do an ls command in the
/tivo/platform/lib/moudles/
the file bcmenet.original is there. I do not see bcmenet.o which i think is expected.

thanks!!

Thinkdiff
02-07-2011, 02:42 AM
cp needs two arguments (which is why busybox is giving you the help page after you run it). To copy into the current directory, keeping the same name as the original file:

cp /tivovar/hacks/Gen06-netopt-ext3/bcmenet.o .

("." in Linux is another way to write "current directory".)

or to set the name:

cp /tivovar/hacks/Gen06-netopt-ext3/bcmenet.o bcmenet.o

rngbld
02-07-2011, 08:52 PM
"."

That worked. I didn't realize the extra period was there.

Thanks a million.

rngbld
02-07-2011, 09:35 PM
ok, I feel like I am close.

when I try execute " tar -xvf /cdrom/tivotools.tar"
which for me would be tar -xvf /tivo/tivo-bin/tivotools.tar
I get no file found.

I copied my file from my cd rom to /tivo-tivobin but I noticed the extension at the end is .7z
tivotools.tar.7z

Do I need to uncompress this? If so how?

If I cant uncompress it, in WinMFS, I will get an uncompressed version. But then my question would be how do I eject the CD so I can insert another one.

Thanks

edit: I unzipped tivotools.tar.7z in windows. I then burned tivotools.tar to a new cd -rom.

Thinkdiff
02-07-2011, 10:24 PM
the MFSLive CD won't be able to read the .7z file. Decompress it on Windows first (to get just a plain .tar file) and then copy it to a USB flash drive. Mount the flash drive in Linux, copy to the TiVo's HD and then extract it.

rngbld
02-07-2011, 10:53 PM
Thinkdiff, again, thanks for your help.

I tried the commands:
cd /tivo/etc/rc.d/
touch rc.sysinit.author

vi rc.sysinit.author
#!/bin/bash


First mistake. I think I typed touch rc.syinit.autor "autor" as now I have a file in the directory called rc.sysinit.autor.
Should I delete this file?

Next, i corrected it by starting the procedure over. I now have a file called rc.syinit.author But when I type in vi rcsysinit.author. The vi editor looks like this
~
~
~
~
~
-rc.sysinit.author [modified] 1/1 100%

As soon as I type in the "#" , for the next command it gives me an error
'#' is not implemented

I have manged to get out of it as to not screw up the file by doing an exit command
:q!

Any ideas?

Thanks in advance!

Thinkdiff
02-07-2011, 11:22 PM
The directions at the beginning of the thread aren't meant to be followed blindly. You need a basic understanding of Linux to get through them.

vi is a text editor. You can look up the instructions on google, but basically - vi starts in command mode. To start entering text, the command is "i". To stop entering text, you press Esc. The command to write is ":w". Quit is ":q".

You can also use pico/nano (I don't remember which one is on the mfslive cd). It's more user-friendly:

pico rc.sysinit.author
or
nano rc.sysinit.author

to remove the file you named incorrectly:

rm -f rc.sysinit.author

rngbld
02-08-2011, 12:57 AM
I forgot to transfer the file tvapppatches-11.0j.tcl to the /var/hacks directory.

In case anyone needs to transfer or ftp a file, I used the method summarized below. Of note, I already had a telnet prompt into the tivo unit and I used a program called "core ftp" checking the box to log in as anonymous. I am a newbie so proceed with caution. Good luck.


http://www.tivohelp.com/archive/tivohelp.swiki.net/50.html

# In telnet, change to the /var/hack directory by typing cd /var/hack
# Change the permissions on the tivoftpd file so that it is executable by typing the following in telnet:

* chmod 755 tivoftpd

# Start the FTP server manually by typing:

* ./tivoftpd [ENTER]

# Now try connecting to your TiVo’s IP address with an FTP client. You can use the Windows command line client by pressing Start, Run, and then typing:

* ftp 192.168.xxx.xxx [ENTER]

# Make sure you use your TiVo’s actually IP address in the above example. Press ENTER twice when your TiVo’s FTP server responds to log in
# To log out and close the connection, type:

* quit [ENTER]

rngbld
02-09-2011, 02:17 AM
Sorry, Stuck again.

I have tvapppatch.tcl and tvapppatches-11.0j.tcl in /var/hacks

When I type the command: tivosh tvapppatch.tcl. I get the following error

We will be patching the running tivo appp.
When done, the patched file will be /tvbin//tivoapp, and
the running tivoapp will be renamed to /tvbin/tivoappp.foo.
(it cant be deleted while running)
Patching active Tivo Software version 11.0j-01-2-652
Looking for patches in ./tvapppatches.tcl...

Abort: Problem with ./tvapppatches.tcl

Any help would be greatly appreciated. In the end, the goal is to remove cci byte, so alternitavely, Could I enter the patch command directly?

Heartbreaker
02-09-2011, 02:30 AM
Did you try the alternative ThinkDiff gave earlier? it's as follows:


chmod 755 tvapppatch.tcl
./tvapppatch.tcl

Thinkdiff
02-09-2011, 03:26 AM
Sorry, Stuck again.

I have tvapppatch.tcl and tvapppatches-11.0j.tcl in /var/hacks

When I type the command: tivosh tvapppatch.tcl. I get the following error

We will be patching the running tivo appp.
When done, the patched file will be /tvbin//tivoapp, and
the running tivoapp will be renamed to /tvbin/tivoappp.foo.
(it cant be deleted while running)
Patching active Tivo Software version 11.0j-01-2-652
Looking for patches in ./tvapppatches.tcl...

Abort: Problem with ./tvapppatches.tcl

Any help would be greatly appreciated. In the end, the goal is to remove cci byte, so alternitavely, Could I enter the patch command directly?

Did you rename tvapppatches-11.0j.tcl to tvapppatches.tcl?

mv tvapppatches-11.0j.tcl tvapppatches.tcl

rngbld
02-10-2011, 12:30 AM
" mv tvapppatches-11.0j.tcl tvapppatches.tcl "

Holy Smokes Batman! Success! Success! Success!
Thanks to everyone for contributing. And a million thanks to Thinkdiff.

Heartbreaker
03-03-2011, 03:01 PM
Yes. The nopromos patch for 11.0j is:
...So it'd go something like this:


mount -o remount,rw /
cd /tvbin
mv tivoapp tivoapp.nopromos
cp tivoapp.nopromos tivoapp
echo -ne "\x0d\x29\x39\xa5" | dd conv=notrunc of=tivoapp bs=1 seek=4619932
mount -o remount,ro /
reboot


This is for 11.0j


Whoa! I just thought of something ... Will this work for 11.0k too? I just thought about that since i have to RE- Hack

psxboy
03-03-2011, 03:14 PM
Whoa! I just thought of something ... Will this work for 11.0k too? I just thought about that since i have to RE- Hack

You only had to revert the nopromos patch because you applied it in 11.0j before realizing that it breaks the video on demand stuff. So that procedure was to un-do the patch. I didn't bother porting the nopromos patch to 11.0k because of the problems it creates, so you won't be affected by it this time around.

-psxboy

Heartbreaker
03-03-2011, 03:17 PM
...so you won't be affected by it this time around.

-psxboy

Cool. Thank you for everything, psxboy.

emuman100
11-25-2017, 08:22 PM
I was able to hack my Tivo HD using this guide. From it, I made notes on everything I did, so if I ever have to rehack, I can do it again. Also, it's always a good practice that you save your original drive. I used it to copy to a larger 2TB drive. I expanded the MFS media partitions for 318 HD hours and 2777 SD hours. I will save the original drive and keep it as a backup.

I was able to find all required files. I now have Jamie's kernel, tivoftp, telnet, ncid, and tivowebplus running. Tystream encryption is disabled. The only thing I need is a copy of mfs_ftp patched for Tivo HD.