NOTE: this information is current, but has been deprecated. the preffered method for getting bash, regardless of version, is to use the monte method. this information is for historical purposes mainly. there are a number of guides which utilize the bash_env method only, i would recommend NOT using them in general.
well, I went ahead and got a new HDVR2 to mess around with, so I thought I would share my observations. I used the hacking guide over at AVS: Hacking the HDVR2 - Alternate version in this thread
A couple things I ran into:
1) I couldn't get bash with the factory image that my unit shipped with. I was able to get a copy of a 3.1.U5-01-2-151 image, and then I was in like flynn. EDIT: specifically, my unit shipped with 3.1.0-01-2-151. That version cannot be hacked with the BASH_ENV method.
2) for some reason, I wasn't able to restore the image I pulled off my original drive back to my original drive. I kept getting errors saying that my drive was too small for the image (yes, i didnt use the -s 127 flag). After grabbing another 40gb drive that was slightly larger, all went fine
3) the tivo will check files on everything except the /var partition, so if you want to hack the rc.sysinit, you should make sure to copy it as a part of your hackinit file. my hackinit file is below. you might be able to skip the rm, but i do it just in case.
4) I chose to add upgradesoftware=false to my bootparams, and i chose to disable the default gateway. this should 'hopefully' keep my unit from being update for now
below is the hackinit that i use:
fixsub/tier stuff works the same as with 3.1 on the series 1 units
export PATH TIVO_ROOT MFS_DEVICE IGNOREEOF
ifconfig eth0 192.168.1.97 broadcast 192.168.1.255 netmask 255.255.255.0
#route add default gw 192.168.1.1 netmask 0.0.0.0 metric 1
tnlited 23 /bin/bash -login &
mount -o remount,rw /
if you want to replace a file on boot, here is some code which can be added to your hackinit. it won't necessarily do what you want due to race condition possibilities, but it works for some things:
# replace myfile with modified copy
rm -rf /path/to/myfile
cp /var/hack/myfile /path/to/myfile