[crashHD]

Here's an actual, proper tcl superpatch, instead of just a patch script. Only works on 6.4a, and only tested on my own unit. It would be appreciated if the first few people other than myself to use it would report back with their results. Successfully tested on multiple units. Thanks.

#!/tvbin/tivosh

# superpatch-67all-NutKase-1.1.tcl by NutKase
# ported by NutKase, et al (several :))
# (C) 09/17/2005
# ---------------------------

#********************************************************************************
# superpatch-6.4a.tcl by CrashHD 
# 6.4a patch locations found by RandC 
# credit goes to NutKase for original patches
    
#********************************************************************************
# Thanks to everyone, especially alldeadhomiez, rc3105, Capableperson66, 
# those heavy-lifters unnamed, and everyone who'll test this.
#
# Currently supports tivoapps from software versions 6.4a.
# 
##########################################################################################################
#                   TERMS OF USE
#
# -superpatch-67all-NutKase-1.1.tcl IS PROVIDED AS-IS 
#  AND DOES NOT CARRY ANY IMPLIED OR EXPLICIT WARRANTY
#
# -superpatch-67all-NutKase-1.1.tcl IS FOR NON-COMMERCIAL USE ONLY.  
# -YOU MUST BACKUP YOUR UNIT BEFORE USING THIS SCRIPT 
#  AS IT MAY DAMAGE YOUR TIVO BEYOND REPAIR
#
# -SALE OF ANY DRIVE OR WHOLE UNIT MODIFIED WITH THIS SOFTWARE IS PROHIBITED
# -USE OF THIS SOFTWARE FOR PROFIT IS PROHIBITED
# -INDIVIDUALS IN VIOLATION OF THE TERMS LISTED ABOVE 
#  WILL BE PROSECUTED TO THE FULLEST EXTENT OF THE LAW
# 
#
##########################################################################################################

#  First Patch, Disable Encryption
#  Second Patch, 30 sec skip (SPS30S)
#  Third Patch, Backdoors
#  The next three are for HMO/HME
#  The next one removes "Tivo Plus Features (trial ends today)"

array set patch_6_4a {

0x005865B8 "0c16a402 3c020000"

0x00A907F0 "1440002b 1040002b"

0x006AD180 "00008021 24100001"

0x004DD458 "00408821 34110000"
0x005116DC "00408021 24100001"
0x0099A1B8 "14400014 10000014"

0x004E0BC8 "0c1445a9 24020000"

}

puts " "
puts "superpatch-67all-NutKase-1.1.tcl"
puts "(C) 05/08/2005 by NutKase, et al - COMMERCIAL USE PROHIBITED"
puts " "
puts "Credit goes to CapablePerson66, rc3105, and others who wish to"
puts "remain anonymous.  We thank ESPECIALLY alldeadhomiez for his time and knowledge."
puts " "
puts "All errors are the fault of Anonymous :-) ."
puts " "
 
set db [dbopen]
RetryTransaction {
  set swsys [db $db open /SwSystem/ACTIVE]
  set sw [dbobj $swsys get Name]
}
dbclose $db
 
puts "Your TiVo Software version is $sw"
puts "Please write down your TiVo Software version."
puts " "
 
 
if { [regexp {^6\.4a-} $sw] } {
    set a "patch_6_4a"
} else {
    puts "Error: Version $sw is not supported."
    exit 1
}
 
puts " "
puts "Checking your tivoapp patch locations..."
puts " "
 
set fh [open "/tvbin/tivoapp" r]
fconfigure $fh -translation binary -eofchar {}
 
foreach {off val} [array get $a] {
    binary scan $val a8xa8 orig new
    seek $fh [expr $off - 0x400000] start
    binary scan [read $fh 4] H* cur
    if {$cur!=$orig} {
	if {$cur!=$new} {
	    puts stderr "At offset $off, expected 0x$orig but got 0x$cur"
	    puts stderr "Aborting...  You need a virgin tivoapp to patch."
	    exit 1
	}
    }
}
close $fh 
puts "Patching your tivoapp..."
puts " "
 
exec mount -o remount,rw /
if { [catch {
    array set patch [array get $a]
 
    file copy /tvbin/tivoapp /tvbin/tivoapp.superpatch;
    set fh [open "/tvbin/tivoapp.superpatch" r+]
    foreach {off val} [array get $a] {
	binary scan $val a8xa8 orig new
	seek $fh [expr $off - 0x400000] start;
	puts -nonewline $fh [binary format H8 $new]
    }
    close $fh
 
    file rename -force /tvbin/tivoapp  /tvbin/tivoapp.original;
    file rename -force /tvbin/tivoapp.superpatch /tvbin/tivoapp;
    catch { exec mount -o remount,ro /  }; # ignore errors from the remount
 
    puts "Success!"
    puts "________"
    puts "1. Your $sw tivoapp was updated with the proper superpatch-67all"
    puts "2. Your original tivoapp was backed up and is called /tvbin/tivoapp.original."
    if { [regexp {^6} $sw] } {
	puts "3. You'll need to run the set_mrv_name_67.tcl, I've included, to 'name' your tivo."
    } elseif { [regexp {^7} $sw] } {
	puts "3. Your 7.x tivo must be subscribed.  "
	puts "   *DO NOT* run any version of set_mrv_name.tcl."
	puts "   Instead, enable MRV and name your tivo via your TiVo account at www.tivo.com."
	puts " "
    }
}]} {
    ;# cleanup: remove  tivoapp.superpatch after any errors
    puts $errorInfo;
    catch { close $fh }
    catch {file delete -force /tvbin/tivoapp.superpatch }
    catch {exec mount -o remount,ro /}
}