(deprecated) HDVR2/DSR7000 Hacking Instructions (was "My HDVR2 hacking experience")

[mrblack51]

NOTE: this information is current, but has been deprecated. the preffered method for getting bash, regardless of version, is to use the monte method. this information is for historical purposes mainly. there are a number of guides which utilize the bash_env method only, i would recommend NOT using them in general.

well, I went ahead and got a new HDVR2 to mess around with, so I thought I would share my observations. I used the hacking guide over at AVS: Hacking the HDVR2 - Alternate version in this thread

A couple things I ran into:
1) I couldn't get bash with the factory image that my unit shipped with. I was able to get a copy of a 3.1.U5-01-2-151 image, and then I was in like flynn. EDIT: specifically, my unit shipped with 3.1.0-01-2-151. That version cannot be hacked with the BASH_ENV method.

2) for some reason, I wasn't able to restore the image I pulled off my original drive back to my original drive. I kept getting errors saying that my drive was too small for the image (yes, i didnt use the -s 127 flag). After grabbing another 40gb drive that was slightly larger, all went fine

3) the tivo will check files on everything except the /var partition, so if you want to hack the rc.sysinit, you should make sure to copy it as a part of your hackinit file. my hackinit file is below. you might be able to skip the rm, but i do it just in case.

4) I chose to add upgradesoftware=false to my bootparams, and i chose to disable the default gateway. this should 'hopefully' keep my unit from being update for now

below is the hackinit that i use:

#!/bin/bash
date>>/var/hack/hackinit.log
PATH=/var/hack/bin:/sbin:/bin:/tivobin:/tvbin:.
TIVO_ROOT=
MFS_DEVICE=/dev/hda10
IGNOREEOF=1000
export PATH TIVO_ROOT MFS_DEVICE IGNOREEOF

/bin/bash</dev/ttyS2&>/dev/ttyS2&

insmod /diag/usbcore.o
insmod /diag/usb-ohci.o
insmod /diag/pegasus.o
ifconfig eth0 192.168.1.97 broadcast 192.168.1.255 netmask 255.255.255.0
#route add default gw 192.168.1.1 netmask 0.0.0.0 metric 1
tnlited 23 /bin/bash -login &
tivoftpd

mount -o remount,rw /

fixsub/tier stuff works the same as with 3.1 on the series 1 units

if you want to replace a file on boot, here is some code which can be added to your hackinit. it won't necessarily do what you want due to race condition possibilities, but it works for some things:

# replace myfile with modified copy
rm -rf /path/to/myfile
cp /var/hack/myfile /path/to/myfile

[mrblack51]

I also was able to get tivoweb 1.9.4 up and going on the unit. I have no idea if the regular 1.9.4 release has issues with the way the unit was modified, since I am using a modified version.

In order to get tivoweb to work on the s2 dtivo, you need to add 151 to the list of suffixes for dtivo units in httpd-tt.tcl. the lines should look like this when done

   if { [lsearch "001 011 031 151" $suffix] >= 0 } {
      set dtivo 1
   } else {
      set dtivo 0
   }

also, you need to replace the ppc binaries which are used by tivoweb with versions compiled for mips. Thanks to some help from wcb, copies of the needed files are attached below. make sure to chmod 777 them before you try to use tivoweb

[TechnoMage]

Thank you very much for the posting of your code and copies of the binaries. This helps a-lot.

[mrblack51]

Attached are mips compiled versions of tyhttpd and mfs_stream. If you setup mfsstreamweb98 like normal, then copy over these files instead of the binaries in that zip.

I used the stuff alldeadhomiez mentioned before recording the show that i tried to extract. Not sure whether the stream was extracted improperly, the patch doesnt descramble properly, or the internal mpeg structure has changed. in any event, vsplit didnt seem to like it.

NOTE: mfs_stream was not compiled with pri1 in this version. not sure if it will matter in the long run, but just FYI.

Edit: after further testing, it appears that the tyhttpd and mfs_stream files work properly (w00t!). now to figure out the scrambling/stream stuff

[mrblack51]

just incase some of you were wondering, these are my bootparams:

bash-2.02# bootpage -p /dev/hda
root=/dev/hda7 upgradesoftware=false BASH_ENV=`mount$IFS-n$IFS/dev/hda14$IFS/mnt;echo$IFS/mnt/hacks`

this is the command I used to apply the params to my drive. replace the XX with the partition as described in Ingineer's directions, and the X with the drive letter for your tivo drive.

bootpage -P "root=/dev/hda7 upgradesoftware=false BASH_ENV=\`mount\$IFS-n\$IFS/dev/hdaXX\$IFS/mnt;echo\$IFS/mnt/hacks\`" -C /dev/hdX

[Combat Medic]

OK, when I try this I just download an empty file from my HDVR2. Any ideas?

-Mike

[mrblack51]

combat: did you use the kmem patch linked earlier in the thread? if not, that would probably be a cause. also, are you sure you are running the tyhttpd server and that mfsstreamweb can find the mfs_stream executable? i have sucessfully pulled shows off using this setup, and while i havent been able to demux them yet, i have been able to determine that the video is being recorded unscrambled via that patch.

to all: the easiest thing to do with that patch is to run it at the end of your hackinit.

[mrblack51]

/tvlib/tcl/updateSoftware.tcl is used by the s2 dtivo to finish an upgrade. two things can be done to modify this functinoality:

1) modify rc.sysinit to never run the code. this can be done by commenting out the following section:

# Check for software upgrade
if [ "$swupgrade" = true ]; then
  /tvlib/tcl/updateSoftware.tcl
fi

by putting # symbols in front of those statements. you can also do a 'swupgrade=false' right above those lines. once you modified the rc.sysinit, copy it to your /var/hack dir and set up hackinit to copy it over the normal rc.sysinit.

2) rename updateSoftware.tcl to something else. you will have to put it back as updateSoftware.tcl if you want to upgrade in the future

[mrblack51]

info for some of the chips in the S2

[mrblack51]

more info

[mrblack51]

edit: stupid file size limits

[mrblack51]

photos of the HDVR2 MB and PS

[mrblack51]

tridge's mfs utils (part 1 of 2)

Edit: after attempting to post these a few times, you get a little distracted. props go out to alldeadhomiez and emuroot for helping with these compiles.

[mrblack51]

tridge's mfs utils (part 2 of 2)

[jdiner]

I am more than happy to work on my tools to get HDVR2 support. 2 people in my family have them now. I just need to get one that is hacked. So I will be reading up on it and trying it on one of these boxes today. If all goes well I should have vsplit S2 aware in short order. And then I can roll all of the changes into TyTool and we should be good.

And no such post would be complete without a big thanks to those that made all of this new fun possible by figuring out the really hard things...

--jdiner