![]() |
Series 2 DIY (no scripts/ISOs) killhdinitrd walkthrough
Series 2 DIY (no scripts/ISOs) killhdinitrd walkthrough
-or- How I learned to stop worrying and love killhdinitrd. After spending several days trying to figure out how to enable telnet and serial bash on my DirecTivo series 2 I was very frustrated... Anything I could find was either a how-to that used Sleeper's iso (which is outdated) and I couldn't find any info on how to use killhdinitrd, so here is a walkthrough of what I did for all you other newbies like me (Who are technically proficient. I will try to explain things, but you better understand linux and low level computer stuff). Everything here is a combination of info I gleaned from the web (mostly these boards) or guessed at based on my (limited) knowledge of the Tivo boot process. Note that I am typing this from memory of what I did last night, so I might make some mistakes... If anyone who knows what they're doing notice a problem, or a better way than what I suggest, please follow up here. To start with, I have a Philips DSR704 DirecTivo (series 2) running software 3.1.1c-01-2-301. Other series 2 boxes should be similar, but YMMV. The end goal: telnet access to Tivo. From here you can add anything you want. I used the following software: Knoppix live linux CD I used version 3.4. I booted this CD to get a usable linux OS to do everything on. mfstools allows backup/restore/copy/enlarging of the Tivo drives pdiskx86 compiled, patched for use with Tivo's modified apple partition table. Knoppix doesn't have the neccessary kernel modifications to read Tivo's partition table, but this program can give you the offset/size of each partition on the disk, allowing you to mount it through loopback killhdinitrd This nukes the Tivo anti-hacking features Extra kernel modules I was using a linksys usb100m, which seems to need the rtl8150 module (not included on Tivo's drive). To tell the truth, I used the rtl8150.o available from this thread, but I assume the module from this whole package would be good too. To start with I out the original Tivo drive (40Gig) and a new 160Gig drive in my office computer (removed my normal drive to make room...) do this however you want, but in the end you need both drives and a cdrom to boot Knoppix from. I had the original Tivo drive as ide chain 1 slave and the new drive as ide chain 1 master, making new=hda and old=hdb. However you attach yours, just make sure you change my commands below appropriately. [Continued in next post due to 5000 char length limit] |
Series 2 DIY (no scripts/ISOs) killhdinitrd walkthrough - part 2
I booted Knoppix, used the web browser to get all of the software above, then opened a shell and became root (su, no password), unzipped/untarred things as neccessary, and started running commands.
The first thing I did was: ./mfstools backup -Tao - /dev/hdb | ./mfstools restore -s 127 -zxpi - /dev/hda This took all of the data (including tv shows [streams]) from my original drive, copied it to my new drive, and enlarged the image (actually added new partitions and linked them into the MFS database structure) to fill my new 160 gig drive. By doing it this way I left my original drive completely un-touched, so that I have a backup, just in case. Be careful to get your drive assignments right. You don't want to accidentally overwrite your original. At this point you could stop the machine and remove the original drive for safety, but you will have to download things again (or for the first time if you plan ahead) as Knoppix only lives in ram. I actually used a USB flash disk to save utilities between reboots, but you don't need to. If you don't think you'll accidentally cat /dev/zero into your original drive, you may not need to reboot at all. At this point you could quit, and you would have a new larger Tivo. The next step on the way to bash access is to modify your startup scripts to start bash/telnet. Also, we will need to modify the kernel/inital_ram_disk so that the Tivo "security" measures don't wipe out our script changes. I believe that by default the kernel/ramdisk image contains a script/process that wipes out the drives and rebuilds them if modifications are detected. The kernel/ramdisk image is checked by the Tivo prom boot code to make sure that they are un-modified. We get around all of this by using killhdinitrd (originally developed for the HD Tivos, can also be used on certain SA and DirecTivo kernel images) to mess up the kernel/ramdisk image in such a way that is still passes the PROM signature checks, but is too broken for the initial ramdisk to be usable. The kernel itself is not modified. This allows us to modify the Tivo's drive without fear of being over-written by the code in the initrd. To start with, I mentioned that Knoppix can't read the partition table from the Tivo drive. I used pdisk to get offset/sizes, dd'ed them to files on my machine, mounted/modified them as needed, then dd'ed them back. The steps I took were: ./pdisk --list /dev/hda It gave: Partition map (with 512 byte blocks) on '/dev/hda' #: type name length base ( size ) 1: Apple_partition_map Apple 63 @ 1 2: Image Bootstrap 1 4096 @ 77261888 ( 2.0M) 3: Image Kernel 1 4096 @ 77265984 ( 2.0M) 4: Ext2 Root 1 262144 @ 77270080 (128.0M) 5: Image Bootstrap 2 1 @ 77532224 6: Image Kernel 2 8192 @ 77532225 ( 4.0M) 7: Ext2 Root 2 262144 @ 77540417 (128.0M) 8: Swap Linux swap 260096 @ 77802561 (127.0M) 9: Ext2 /var 262144 @ 78062657 (128.0M) 10: MFS MFS application region 1048576 @ 78324801 (512.0M) 11: MFS MFS media region 33100800 @ 44161088 ( 15.8G) 12: MFS Second MFS application region 1048576 @ 79373377 (512.0M) 13: MFS Second MFS media region 44161024 @ 64 ( 21.1G) 14: MFS New MFS Application 1024 @ 80421953 15: MFS New MFS Media 232153088 @ 80422977 (110.7G) 16: Apple_Free Extra 5743 @ 312576065 ( 2.8M) Which told me where to find my partitions. Tivo keeps two sets of partitions around for upgrade purposes. I think you should try to determine which set of kernel/root partitions are active, make changes to that set, then write that set back to both active/inactive sets, but I was lazy. I found that only my partition 6/7 had anything useful in them (3/4 had no kernel signature and no mountable filesystem) so I just modified 6/7. I didn't even duplicate it onto 3/4 when I was done because I didn't know if my hacks were finished yet, but you can do whatever you want. Actually, now that I have bash access I suppose I could use dd right on the Tivo to copy over to the inactive partitions. One thing I don't know though... kernel partition 3 is only half the size of 6... can I just truncate partition 6 if duplicating to 3? Does anyone know? Anyone? Bueller? [Continued in next post due to 5000 char length limit] |
Series 2 DIY (no scripts/ISOs) killhdinitrd walkthrough - part 3
If partitions 6 and 7 doesn't work for you, try 3/4... I knew (through repeated attempts) that 6/7 were my active partitions, so the following commands only reference them. You may need to work on 3/4 instead.
I ran: dd if=/dev/hda of=tivokernel6 count=8192 skip=77532225 (fill in your numbers instead of mine) ./killhdinitrd tivokernel6 dd if=tivokernel6 of=/dev/hda count=8192 seek=77532225 (fill in your numbers instead of mine) Watch for errors in there... if killhdinitrd doesn't work then you might have hit you inactive partition set instead of the active ones. The counts the seek/skip came from the length and base in the ouput of pdisk. Make sure you use the numbers from your pdisk output, not mine! If this succeeds, you should now have a nuked initrd in your kernel image, meaning you can modify the drive without making Tivo's prom mad. Next I ran: dd if=/dev/hda of=tivoroot7 count=262144 skip=77540417 (fill in your numbers instead of mine) mkdir /mnt/tivo mount tivoroot7 /mnt/tivo -o loop=/dev/loop3 Tivo's partition table is weird, but its root partition is just ext2. This mounts your Tivo's root file system in directory t, you can go in and look around. In my following comments, I will not be including /mnt/tivo in my paths, although it will be implied, I will just refer to "Tivo's etc directory", or "Tivo's bin directory" so be sure you actually are in the right place. When you are done making modifications to Tivo's root drive (described below) you can finish up and right the data back to the drive with: umount /mnt/tivomnt dd if=tivoroot7 of=/dev/hda count=262144 seek=77540417 (fill in your numbers instead of mine) Modifying your root drive: Do whatever you want. Seriously. It's a linux machine. My crappy instructions won't have meant much to you unless you had some idea what you were doing in linux anyway, so have at it. In order to enable serial and telnet bash, here's what I did: I copied rtl8150.o into /lib/modules I made an /etc/rc.d/rc.sysinit.author file with the following in it: #/bin/bash export PATH=$PATH:/var/hack/bin insmod /lib/modules/usbcore.o insmod /lib/modules/usb-ohci.o sleep 5 insmod /lib/modules/rtl8150.o sleep 5 ifconfig eth0 192.168.13.23 netmask 255.255.255.0 route add default gw 192.168.13.254 netmask 0.0.0.0 metric 1 tnlited 23 /bin/bash /bin/bash < /dev/ttyS2 >& /dev/ttyS2 & Remember to make rc.sysinit.author executable (chmod +x rc.sysinit.author) rc.sysinit runs at boot up, calling rc.sysinit.author (if it exists). My one here doesn't do much other than load the usb 1.1 drivers and the rtl8150.o module. This was all I needed for the usb100m. If you have a different network adapter you might need a different set of modules, search around this board. Next the script configures my ethernet, starts the telnet server, and starts a bash console on the serial port. The serial port was a big help to me. Make a cable with a DB9 on one end and a 3.5mm stereo phono plug on the other end. DB9 pin 5 goes to the sleeve in the phono, DB9 pins 2 and 3 go to ring and tip (I don't know which connects to which, I just tried one way, and it didn't work, so I swapped them. It was honestly faster to just try twice than to look for the right way on the net. Besides I have no idea where my multimeter is at the moment, and the headphone cord I cut up was very un-clear on which wire went to tip/ring. of course, ground/sheild was the sleeve). With the last line in rc.sysinit.author and this cable you can connect to the Tivo at 9600-8-n-1 and watch /var/log/messages and insmod things by hand if it doesn't go well. umount your root image, dd it to the disk (as above), shutdown, put it in Tivo, plug it in, and cross your fingers. If you get lights (ANY lights) on your network adapter, then at least some of the modules loaded (otherwise the USB ports aren't powered). If you can ping Tivo, you have an eth0. If you can telnet in, wohoo! If not, make that serial cable and start debuging. From here on there are a few things to notice: Tivo mounts the drive read-only be default, to make any changes, do: mount -o remount,rw / To transfer stuff onto Tivo you can use rz over the serial link, but it doesn't work over telnet (I might look into that.. Others here mentioned that zmodem doesn't like TCP, but I've been using rz/sz through ssh for many years, so this somewhat bothers me) You may want to put tivoftpd.mips on the drive while it is still in your computer to ease this problem. (You did read these instructions fully before starting, right?) The ftp daemon and MANY useful utilities (chmod, joe, ping) are available at tivoutils.sourceforge.net. Next you'll probably want tivoapp or mfs_ftp... I don't know yet, you've caught up to me. |
Great tutorial!
If the 3.1.5d is truly rolling out to DirectTiVo2s I'll be sure to use this method once I get it. |
You know, you could use the "revalidate" option in tivopart (comes from the same place you get pdisk from) and not have to deal with dd'ing the partitions in an out. Once the partition map is updated in memory, you can simply mount your tivo partitions, such as mount /dev/hda4 /mnt/tivo
|
tivopart
Wow, tivopart is a lot better. Thanks! I couldn't find it on the site with pdisk, but I did find it in this thread
I just booted my Knoppix disk again, ran "tivopart r /dev/hda" and was able to mount everything as advertised.... This is faster, easier, and didn't use 128 meg on my Knoppix ramdisk. I am curious that on my system it didn't display/revalidate partitions higher than 13. I'm also amazed that a user process like this can mess with the kernel's memory. Definitely going to have to look through the source on that. |
You needn't resort to trial and error to find out whether 3/4 or 6/7 is the active pair -- just use "bootpage". This was a necessary tool with monte, and it's still useful will killhdinitrd, though you can get by without it. bootpage will let you see or change the current boot parameters, or swap the active pair.
I don't have a URL handy, sorry. |
bootpage
I found bootpage here. If you don't want to download it, what I actually did on one of my first stumbling attempts was "dd if=/dev/hda count=1 | hexdump -C". the "root=" string was why I first started with parition set 6/7, only later did I find that 3/4 was empty.
|
It sounds as if you've used a lba48 compatible kernel on Knoppix when using mfstools. Thus mfstools expanded the MFS region to use all 160 GB of your new drive. Your partion table confirms this.
I see nothing about you installing an lba48 compatible kernel on your TiVo to correctly access all this space. I suspect you'll run a few days until you fill up the drive and then bad things will happen. |
Quote:
|
What does homer say?
Quote:
That makes perfect and unfortunate sense. I was hoping to find a 2.4.4 LBA48 kernel posted here, but couldn't. I guess I'll either use a 2.4.18 and replace all of my modules, or re-do my upgrade without the offending 23 GB and continue living in my blissful world of barely hacked tivo. :( |
Clarification for Series 1 vet / Series 2 noob
OK... So I finally decided to take the plunge and buy some series 2's to replace my TivoNet'd / TurboNet'd and otherwise upgraded / hacked original Phillips 112's...
Seems there's a whole new world out there that I am not understanding.. The original title of this thread was "S2 DIY" but immediately there was discussion about it being about the DTIVO units, and I just wanted some clarification... First of all, I have already backed up / upgraded the hard drives. All is well, and I have two sub'd series 2's with 80 gig drives. At this time, I dont have much need for anything LBA48-wise... I'm happy for now with my two 80's. My desire is to get the caller-id, tivo-web, etc.. features that everyone is talking about, without losing my HMO and online scheduling if possible.. and I'm not sure if I have to worry about the killhdinitrd or not.. I thought I remembered from long ago that the security stuff was only for the secure tivo's (DTIVO / HDTIVO), but maybe not.. So, my question is simply, can I mount my 80 gig drives like I always did with my series 1 boxes, and just play around from there, or do I have to worry about the killhdinitrd? I'm pretty comfortable with the linux box and tools, except that I'm not fluent in kernel replacement/patching techniques. This thread appears to make it simple enough to understand what I want to do, but if someone could verify for sure if a stand alone S2 tivo with current software will need the security patch, I would be GREATLY appreciative!! Thanks! -Steve |
Quote:
-psxboy |
Thanks for the response..
I really agree with the sentiment here that learning to do it manually is the only way to go, which is why I'm still 'unhacked' other than the larger drives.. I do hope to get some video extraction done soon too... So, what I'm assuming is that after I figure out the killhdinitrd, which doesn't look so cryptic, I'll be able to manually put in whatever I want... Thanks! -Steve Quote:
|
Quote:
NutKase |
Problems with proceedure
Thanks for posting this thread. After reading through this and many other related threads I decided it was time to upgrade my system.
I have a series 2 Directivo box running 3.1.1d. I had no problem with the hard drive upgrade (40GB -> 120GB) using the MFStools 2.0 and the instructions that come with the tools. The system us up and running and I was able to preserve all my shows. However, when I got to the killhdinitrd proceedure I couldn't get very far. I can run pdisk -l /dev/hda and get the following result: Partition map (with 512 byte blocks) on '/dev/hda'I ran tivopart.x86 as suggested earlier in this thread and it ran with no errors. However, when I went to mount a partition it wouldn't work: # mkdir /mnt7I tried "-t ext2" but got: mount: wrong fs type, bad option, bad superblock on /dev/hda7,I even tried the original dd method suggested in this thread: # dd if=/dev/hda of=tivokernel7 count=262144skip=75411521Hopefully I'm missing something simple here. Does anyone have a suggestion? |
if you use a Tivo aware boot disk, then you can just do
pdisk /dev/hda and mount /dev/hda7 /mnt without having to mount any loop back devices. I just did killhdinitrd /dev/hda6 and 'fixed' my kernel. The MFS Tools 2.0 disk should work as a boo tdisk. On the tivopart thing... looked at that a bit but decided against it. Does it' move your partions around so you have a larger root partition. Once the partions are moved, your going to have to re-format them and repopulate them. You might want to try everything without tivopart and see if that works first. jack |
Quote:
I also tried Koppix, with exactly the same result. Quote:
In summary, I did try the mount booted from MFStools 2.0 CD prior to running the tivopart command and it failed as above. |
are you sure that /dev/hda7 has a valid root file system?
... did you do bootpage -p /dev/hda7 to print what root your tivo thinks it's using? the 'unable to determine file system message' occurs when linux can't see the first few btyes of the file system and figure out what type of file system it is. Maybe you should be using /dev/hda4 instead of /dev/hda7. you don't need to do tivopart ( to mess with the in-memory partion table ) if you boot with the MFS Tools 2.0 boot disk. It understands Tivo Partitions. I was able to mount /dev/hda7 /mnt just fine with my system booted up with e MFS Tools 2.0 boot cd. Is this a 'restored' copy made from your backup or is it your main/only/primary Tivo drive. Do you know for a fact that /dev/hda7 and /dev/hda4 are 'ok' if you boot it up in your tivo? You didn't do anything with 'byte swapping' did you? I think that you used to have to do byte swapping with the S1 tivos, but you don't do that any more with the S2 tivos. jack |
My drive is working. I have it in my dtivo now and it is able to record, playback, and play live TV just fine. I'll try the /dev/hda3 and /dev/hda4 paritions tonight and post the results. It was getting late and I didn't think about trying 3/4 instead of 6/7.
|
I am trying to run the killhdinitrd on my 3.1.1d tivo, but it will not work. It keeps erroring out telling me basicly that the kernel version is not valid. Is there an updated version or a workaround to this?
|
Quote:
|
Quote:
|
Quote:
|
There seems to be a lot of confusion over this... the kernel alone does not constitute the "Software Version"! The only way your Tivo knows it upgraded is by the entries in the SwSystem section of the MFS database, so you can copy kernels around with impunity and not tip off the Tivo that anything has changed. Also, the 3.1.1c kernel is identical to the 3.1.1d kernel... the ONLY things that changed between them are the hashes in the initrd and the copyright notice/build time of the kernel.
So what does this mean? It means you can use the killhdinitrd'd 3.1.1c kernel in place of the new 3.1.1d kernel. To answer the question about copying a kernel from the 4MB partition to the 2MB partition: dd if=/dev/hdaX of=/dev/hdaY bs=1000 count=2000 ...will only copy 2MB from the source partition to the target partition. Incidentally, the kernel is right around the 2MB mark in size anyway... the rest of the space in the larger 4MB partition is unused. -psxboy |
Quote:
The only feature I'm looking for is enabling USB so I can watch streams over MythTV: http://www.dealdatabase.com/forum/sh...threadid=22972 Thanks! |
How would you go about writing a 4.01a kernel (vmlinux.px) back into the 4.01b partition?
Welp, I did it by just dd'ing the file into the partition, seems to work. |
Quote:
-psxboy |
Quote:
-psxboy |
Thanks so much psxboy, that really helps!
|
newbie help
knoppix loads a GUI environment
How do I run pdisk? At a command line? |
Quote:
I'm trying to do this to a DVR80 with an upgraded hard drive of 120 gig, running 3.1.1c software. Thanks for any help. |
Quote:
But read down to posts 5 and 6 for a pointer to the tivopart utility. Using its "revalidate" option enables your Linux to see the TiVo drive's partitions (and even mount the ext2 partitions). Then killhdinitrd can work directly on the kernel partiton, as you wrote. However, it's still a good idea to make a copy onto another drive so that a) you have a backup of your original kernel, and b) have a little more protection against making a mistake (like writing the wrong thing to the wrong partition). tivopart's intended purpose is to enlarge several of the Linux partitions, but that requires extra steps. If you don't thoroughly understand that procedure, I recommend you save that for a later upgrade. |
If I use MFSTools and killhdinitrd, do I need to modify the partions? I was able to run it on hdc6 (I think, I'm at work and can't check my notes) and I didn't get any errors stating it didn't work. But I wasn't able to get the rc.sysinit.author file to work. So I know I have more reading to do, but if I didn't get any errors running killhdinitrd, does that mean that part worked?
|
3.1.1d and local channels
Well I have ran into trouble.
I just got local channels and they could not for the life of them get them to work on my tivo. Finally figured out that you HAVE to have v3.1.1d for the local channels to work on my tivo. If I go back to v.3.1.1c local die and all I get is a black screen. Sooooo we really need to get support of D Sheriff |
Quote:
done the clrear and delete everything thing.... jack |
Quote:
-psxboy |
Presumably sheriff is saying that he's got 72.5 locals, since that's in fact what the d upgrade is all about. What he hasn't realized is that he can run the 3.1.1d software with the (killhdinitrd'ed) 3.1.1c kernel.
|
Quote:
I've seen this phrase a lot... but never an explination.... jack |
They put up a new satellite at 72.5 degrees, carrying locals for some new markets. They sent out the d software update to enable the DirecTivos to tune in the new sat. (You also need a new dish.)
|
| All times are GMT -4. The time now is 11:00 PM. |
Powered by vBulletin® Version 3.8.4
Copyright ©2000 - 2010, Jelsoft Enterprises Ltd.
Copyright 2000-2008 © dealdatabase.com.