Stop sat. software updates--how

[yngdiego]

Now that the hacking is getting more advanced, I'm thinking Dave will try to send entire Tivo OS updates down the satellite feed. And if he sends a new PROM that does some sophicated CRC checking then hacking it could be extremely difficult. That would probably really please Dave/Tivo.

So now that it seems PGM is into DTivos, I wonder if he or anyone else has some cleaver ways to make 99.999% sure that we can block software updates if the should come down the sat feed.

[Taran]

Being there hasn't been a software update via sat no one really knows how to protect against it. Some basic ideas you can try are edit the rc.sysinit file and take out the parts that update software or prom (search for the word update in comment lines). Also the /var/util directory has a lot of utils you really don’t want on your Tivo, the packages directory will most likely be used for updates (lock that down), and other utils throughout the tivo you should find and destroy.

I think there is a lot of people that can throw out some good ideas and I hope they will, but keep in mind that none of these are tested they are just ideas.

[BubbleLamp]

Just be careful what you mod in rc.sysinit. I got over ambitious and ended up with a non-bootable system. Also, if you have enabled Showcases to work, be careful what you do to the packages dir. That's where they get D/L'd before being moved into MFS.

[Taran]

Are you sure about the package directory?? I have removed my package directory and installed the SC.TCL last night. It ran and I got my showcases and tivomag. All the graphics are there and work along with the showcases. On one of my Tivo's I am also still running the remove logs every call.

Maybe the SC's are using the tmp or install directory??? Also I haven't heard anyone talk about the install directory but it seems like that might rank as a risk as well???

[BubbleLamp]

Don't know what to say, the Showcase slices do load into the packages directory before processing. When there is no packages dir, who knows. Try enabling your logs temporarily and see what they say.

[Taran]

Ok, I will do this but being how it doesn't update till late night (so it looks) it will take days to get you the results of letting logs go, recreating directories, etc.. I will get back to you though as soon as I have some basic ideas down...

[Taran]

I had a tivo I didn't clear the logs on yet. I am not sure what log you want me to look at but here is a print from the "svclog". This Tivo had the packages directory renamed to packages-old. The other Tivo has it totally removed (now).

aval_file TCD_ID=00100002020Fxxx CALL_ID=1013938xxx TIME=1013941834 AVAL_ID=00002DD700003xxx FILE_NAME=Affiliation/affiliation-9.slice.gz FILE_STATUS=IGNORE_ALREADY_HAVE
aval_file TCD_ID=00100002020Fxxx CALL_ID=1013938xxx TIME=1013941835 AVAL_ID=00002DD700003xxx FILE_NAME=Irdb/irdb-77.slice.gz FILE_STATUS=IGNORE_ALREADY_HAVE
aval_file TCD_ID=00100002020Fxxx CALL_ID=1013938xxx TIME=1013941835 AVAL_ID=00002DD700003xxx FILE_NAME=Logo/logo-37.slice.gz FILE_STATUS=IGNORE_ALREADY_HAVE
aval_file TCD_ID=00100002020Fxxx CALL_ID=1013938xxx TIME=1013941835 AVAL_ID=00002DD700003xxx FILE_NAME=ReleaseShowcase/Standard/showcase1-11734-769.slice.gz FILE_STATUS=IGNORE_NOT_IN_GROUP
aval_file TCD_ID=00100002020Fxxx CALL_ID=1013938xxx TIME=1013941835 AVAL_ID=00002DD700003xxx FILE_NAME=ReleaseShowcase/TiVoPromotion/showcase1-11734-769.slice.gz FILE_STATUS=IGNORE_NOT_IN_GROUP
aval_pp TCD_ID=00100002020Fxxx CALL_ID=1013938xxx TIME=1013941835 AVAL_ID=00002DD700003xxx STATUS=SUCCESS
cam_id TCD_ID=00100002020F68B CALL_ID=1014024xxx TIME=1014025025 ID=0002-3543-3xxx
ird_id TCD_ID=00100002020Fxxx CALL_ID=1014024xxx TIME=1014025025 ID=5320Fxxx
tclient_dialcode TCD_ID=00100002020Fxxx CALL_ID=1014024xxx TIME=1014025036 CODE=10 PHONE=6175315304 PREFIX={} CALL_WAIT_PREFIX={} PHONE_AVAIL_DETECT=0 DIAL_TONE_DETECT=1 TONE_OR_PULSE=T MODEM_MODE=V90
tclient_result TCD_ID=00100002020Fxxx CALL_ID=1014024xxx TIME=1014025041 STATUS=Succeeded
aval_file TCD_ID=00100002020Fxxx CALL_ID=1014024xxx TIME=1014028242 AVAL_ID=00002DD800003xxx FILE_NAME=Affiliation/affiliation-9.slice.gz FILE_STATUS=IGNORE_ALREADY_HAVE
aval_file TCD_ID=00100002020Fxxx CALL_ID=1014024xxx TIME=1014028242 AVAL_ID=00002DD800003xxx FILE_NAME=Irdb/irdb-77.slice.gz FILE_STATUS=IGNORE_ALREADY_HAVE
aval_file TCD_ID=00100002020Fxxx CALL_ID=1014024xxx TIME=1014028242 AVAL_ID=00002DD800003xxx FILE_NAME=Logo/logo-37.slice.gz FILE_STATUS=IGNORE_ALREADY_HAVE
aval_file TCD_ID=00100002020Fxxx CALL_ID=1014024xxx TIME=1014028729 AVAL_ID=00002DD800003xxx FILE_NAME=ReleaseShowcase/TiVoPromotion/showcase1-11734-769.slice.gz FILE_STATUS=SUCCESS
aval_file TCD_ID=00100002020Fxxx CALL_ID=1014024xxx TIME=1014029009 AVAL_ID=00002DD800003xxx FILE_NAME=ReleaseShowcase/Standard/showcase1-11734-769.slice.gz FILE_STATUS=SUCCESS
aval_pp TCD_ID=00100002020Fxxx CALL_ID=1014024xxx TIME=1014029009 AVAL_ID=00002DD800003xxx STATUS=SUCCESS

[BubbleLamp]

Thanks Taran. Looks like it did process the last few files correctly. Guess we'll need to dig further to see what the script is doing.

Found these variables defined in Inc.itcl:

namespace eval Inc {

# TiVo Center Definitions
variable TC_DOWNLOAD_DIR "/var/packages"
variable TC_INSTALL_DIR $TC_DOWNLOAD_DIR
variable TC_SVC_LOG_FILE "/var/log/svclog"



Still not sure what it does when the variable doesn't exist! :confused:

[PGM]

Guys, /var/packages is ONLY used for the phone/net calls back home, NOT for the service downloads! The service downloads go directly into the MFS and are deleted immediately after being processed. TIVOAPP will need to be 'massaged' in order to 'control' the service download :)

pgm

[Taran]

Thanks PGM for the good information.

[DaKillaWilla]

Does a call need to be placed first??? Or can SC.TCL be ran and thats all you need to get the mags and shows??

[Taran]

You need to have a system that is subbed. Most the people that are using this are people that have used Xtreme or at by hand installed fixup02c.tcl to cause there system to be subbed. If you are calling in with a phone line you don't need sc.tcl