(deprecated) HDVR2/DSR7000 Hacking Instructions (was "My HDVR2 hacking experience")

[wkendrvr]

What did you use to create that? you might have a control char or something in the line...

here is mine

bash-2.02# cat callfixsub.tcl
while true; do
{
date > /var/hack/fixsub.log
/var/hack/fixsub31.tcl
sleep 82800
}
done

[kmon]

Originally posted by mrblack51
I used the hacking guide over at AVS: Hacking the HDVR2

Anybody have a local copy of this that they can post as the tivocommunity is down?

[wkendrvr]

Sorry no links but here is the post from Ingineer



I can find a plethora of threads on the S2, but nothing specific to the DTiVo S2, so I decided to create this, it is “newbie-grade”, and will allow others to get an idea of what’s going on with a “hands-on” approach.

I am basing these instructions on my "Test" unit, which is a HDVR2 that shipped with 3.1.U5-01-2-151.

I was tempted to create a automatic utility to do all this for someone, but that way you can’t learn!

Note: The Ethernet adapter is discussed in a later post down in the thread farther!

HOW TO OBTAIN A SERIAL BASH PROMPT and/or UPGRADE CAPACITY:

1. If you don't already have these 5 things you will need them to begin:
a. Torx T-10 Screwdriver
b. An open Windows 95/98 PC, (FAT32) that has at least 2g free space, and will boot from CD. You CANNOT use XP or 2000 with NTFS, as those partition types cannot be written to via the Linux boot CD. (you can also use Linux, but I am not going to detail this here)
c. A copy of the MFSTools2 Boot CD or better yet, the version created by Jonnydeath that includes all of the extra files mlar used in his pioneering effort. Jonnydeath is kind enough to provide this to you as a downloadable ISO image at: http://star1.jongans.com/mfstools2.iso Kudos mlar and Jonnydeath! (download and burn the ISO image to a blank CDR)
d. A spare IDE cable. Type is not too important for this operation.
e. A TiVo PC to 1/8" Serial cable. Instructions for making this are in various locations throughout the forum. Make sure it is done correctly, as I envision this is the most common source of problems. If you don't have decent electronics experience, I suggest you order this cable pre-made from somewhere like 9thtee.
f. (Optionally) A new HD for your TiVo at least Equal or Greater than your originals capacity. I used a 120g Maxtor for mine.

2. Disconnect Power to the TiVo. I recommend you leave the AC plug plugged into a Power strip and just "turn-off" the strip to preserve the Static ground path through the power supply. It is winter after-all!

3. Open the Unit using your Handy T-10 Torx Driver. Note that TiVo seems to have finally given up on the cheesy "Warranty Seal" used extensively on the S1.

4. Disconnect the cables (Power and IDE) from the Hard drive.

5. Remove the Hard Drive and Bracket assembly by removing the two T-10 Torx screws located on the Hard Drive Bracket between the Drive itself and the Front of the TiVo.

6. Treat the hard drive like a waiting heart transplant, and carefully take it to the PC and hook it up as the Secondary Master all by itself. This may require you to unplug your CDROM and reconfigure it as Primary Slave if it is not already like that. This configuration can be varied, but I don't recommend it, as my instructions are going to assume this configuration. Any other IDE devices should be unplugged. So you should have your Windoze FAT32 drive as Primary Master (IDE0), your CDROM as Primary Slave (IDE1), and your TiVo heart as Secondary Master (IDE2). You should not need to change any jumpers on the TiVo drive.

7. Insert the MFSTools2 bootable CD in the drive and boot the PC. You should quickly get a prompt that that asks for boot options. Just hit ENTER. Linux should now boot, and may ask you to login as root. Once logged in you will be at the # prompt.

8. Mount the Windows drive by using the following command:
mount /dev/hda1 /mnt/c

9. Verify you can "see" the Windows drive by doing an ls /mnt/c and you should see a directory of your Windows C drive. Also verify you have at least 2 gigs free on that partition by using the df command.

10. No we are going to create a backup of your TiVo drive for safety reasons. Execute the Following Command:
mfsbackup -f 4138 -6so /mnt/c/tivo-s2.bak /dev/hdc
This will create a file in the root of your Windows drive called tivo-s2.bak that will contain a complete image of the new TiVo drive, it will be approximately 1.2g in size. Be sure this command completes successfully before you move on to the next step. It took about 5 minutes on my setup, so feel free to go have a snack and Watch something on your Series 1.... ;-)

[wkendrvr]

part 2


11. (optional) Now, here is where you choose to play it safe by using a new drive or keeping the original. We have not yet modified the TiVo drive in any way, so by keeping it intact, you have a sure-fire failsafe. I also desired to upgrade my capacity at this point, so I opted for a 120g 5400 rpm Maxtor to replace the existing 40g Maxtor my HDVR2 came with. If you are going to replace the drive, you now use the "three-finger salute" (CTRL-ALT-DEL) to halt Linux (this will safely unmount your windows drive). DO NOT power off the PC until it reboots! Once it reboots, then power it down. Remove the TiVo drive, take the Bracket off, and put it somewhere safe. Mount the bracket on the NEW drive, making sure it is set for Master first. Install it in the PC and reboot just like before, including the step to mount your windows partition. Do not run MFSbackup though!!!

12. Ok, now here is were we reverse the process and restore the backup on your drive. You have to perform this step even if you are re-using the TiVo original drive (not recommended), as we are going to use MFSrestore to create some additional partitions that are not present on your drive already. Note: Leave OUT the "-s 127" if you are re-using the "stock" drive! Your Windows partition should be mounted and ready to go, then type the following command:
mfsrestore -s 127 -xzpi /mnt/c/tivo-s2.bak /dev/hdc
This will re-write the backed up data from the Windows drive to the target TiVo drive and add the extra partitions. Once this process completes successfully, reboot the machine with CTRL-ALT-DEL and get back to the # prompt. Do not re-mount the Windows partition. Press and hold SHIFT and use the "Page Up" key to scroll back through the kernel boot messages, looking for the "Partition Check" where it will list all the partitions found on /dev/hdc. Make a note of the LAST hdcXX, with blank line after the name. Also, The line above the blank one we want should list a partition type called "Apple_Free", YOU WILL BE USING THE BLANK PARTITION FOR THE ROMFS STEPS BELOW! Mine was 16, which may not be one used on your drive, but NO MATTER WHAT, THE NUMBER WILL BE OVER 10! If for some stange reason it is not, DO NOT PROCEED! I also recommend You power down the PC at this point and put the New TiVo drive back in the TiVo for a quick test to be sure it worked. Since I was upgrading, I wanted to see the magic 3-digit "recording Capacity" number show up in the System Info screen. It did! YES! =) If all is well, power down the TiVo and put the drive back in the PC and get it back to the # prompt as before.

14. Notice I skipped 13. I didn't want anything to screw up when everything has worked perfectly so far! =) Ok, now this is where we begin the modifications that mlar originally developed to get that prompt! Mount Jonnydeath’s CD by typing mount /dev/hdb /cdrom It will proceed to tell you that it is a read-only file-system, and that is it mounting it accordingly. CD to the mount by typing cd /cdrom then do an ls to verify that the img subdirectory, the genromfs and the bootpage utilities are there. (if they are not, you didn’t use Jonnydeath’s MFStools version!) Now lets verify your system is like mine was, and type this command:
bootpage -p /dev/hdc
It should spit out "root=/dev/hda7" which confirms the TiVo’s active root partition is 7, so that makes the VAR mount point at 9. Lets now mount the var partition by typing:
mount /dev/hdc9 /mnt/tivo
Then we check it by doing a:
ls /mnt/tivo
Now verify you see at least stuff like the "log" and "utils" subdirectories. Now if that is ok, we are ready for the actual modifications. The first chore is to generate the small ROMFS image that we will be placing on the last Blank Partition (determined in step 12). Do this by typing the following:
genromfs -f /romfs.img -d img/
This command should create a 1024 byte file in the root directory called romfs.img containing the ROM file system image which has the “hacks” file in it from the img subdirectory. Now we are ready to write it to the blank partition at the end of the TiVo drive. The blank partition we will use was created by us and determined in step 12. Make the write by typing this command:
(Note: The blue XX should be replaced with the blank partition number determined in step 12!)
dd if=/romfs.img of=/dev/hdcXX bs=1024 count=1
This command does a direct binary copy (dd) of the “infile” romfs.img directly to the partition which is located at device handle /dev/hdcXX. If all goes well you will see "1+0 records in" and "1+0 records out" and we have inserted our secret “hook” code into the last partiton on the TiVo drive. On to the next step.....

[wkendrvr]

part 3


15. Ok, now we have a block of code in the last partiton, and we will still need to “hook” it by passing kernel parameters at boot time by altering the boot page. What this code in the last partition will do is look for a file called “hackinit” in the /var/hack subdirectory and execute it when we "trick" the kernel into running it for us. In that "hackinit" file we can place anything (such as a BASH shell) we wish to have the TiVo run at startup. Now we will create that "hackinit" file and load it with a command to invoke our BASH prompt on the HDVR2’s serial port. Type:
mkdir /mnt/tivo/hack
This will create our “hack” directory in TiVo’s var subdirectory. Then type:
mkdir /mnt/tivo/hack/bin
And this makes our bin subdirectory and then:
cp -p /cdrom/devbin-s2/* /mnt/tivo/hack/bin/
That will copy over all the essential binary commands we will need to use the BASH shell. Now all we have to do is create the “hackinit” file to call our BASH shell. Do this by typing the following; Hitting ENTER after each line:
(Note: be very careful to get it 100% perfect or it may not work – Be ESPECIALLY sure to get the case right in ttyS2!)
cat >/mnt/tivo/hack/hackinit
#!/bin/bash
date>>/var/hack/hackinit.log
PATH=/var/hack/bin:/sbin:/bin:/tivobin:.
/bin/bash</dev/ttyS2&>/dev/ttyS2&
Once you hit ENTER on the last line, press CTRL+D to close the file. DOUBLE-CHECK your work, because if even one character is wrong, it will not work! If you realize you made a mistake, begin again at the “cat”. Once you have verified, we need to make it and the other commands executable by doing this:
chmod -R 777 /mnt/tivo/hack
Which completes that, now all that remains to be done is the boot page “hook”.....

16. Ok this is the final modification, we hook the code in the Last Partition (determined in Step 12) by typing this VERY CAREFULLY:
(Note: The blue XX should be replaced with the blank partition number determined in step 12!)
bootpage -P "root=/dev/hda7 BASH_ENV=\`mount\$IFS-n\$IFS/dev/hdaXX\$IFS/mnt;echo\$IFS/mnt/hacks\`" -C /dev/hdc
Make 100% sure you get the case proper, and be VERY careful to make the “reverse single quotes” properly. Most people mess this up. There are 2 in the line, each one is preceded by a backslash (\) and is usually made by pressing the key near the upper-left of your keyboard (on the same key as the ~). If you don’t get this correct, this will all fail, So triple-check the line before hitting enter! Once this command completes, you are ready to unmount the TiVo drive with the “Three-finger salute” (CTRL-ALT-DEL), wait for the PC to reboot, then power it down and move the TiVo drive back to it’s home!

17. Ok, here is the Final step, if all goes well, you should have a BASH prompt! Connect your new serial cable to the Serial port on your PC, and open a standard VT-100 type terminal communication package such as HYPERTERM or MINICOM, being sure to set the PC’s port to 9600-8-N-1. Test the setup by using something metal to short the first 2 contacts (the small tip and little ring after it) on the 1/8” plug on the other end of the cable. When you type on the PC, and that bridge is in place on the 1/8” connector, you should see all the characters “come back” (echo) to you. If you don’t, troubleshoot your COM port setup, and/or cabling. Now plug the 1/8” plug into the back of the TiVo where it is labeled “Serial”. Restore power to the TiVo and watch the PC. Right before the TiVo changes from “Welcome. Powering up..” to “Almost There” you should see this:
bash: no job control in this shell
bash-2.02#
Now you should be able to “move around” in your TiVo. Be careful not to invoke any commands that do not auto-terminate, as there is no job control on this shell! (Can’t CTRL+C to stop them).

CONGRATULATIONS, You are a TiVo Hacker! =)

My next “installment” to this section will be how to add the USB Ethernet support. I have to go out and get one of those 3-Com USB Ethernet adapters, first! Once I get that done, I will try and add a TivoWEB “How-to” for the HDVR2.

If you are going to “experiment”, it might be a good idea to go backup your TiVo drive again first. Use the same procedure as outlined in steps 8-10, except I recommend you choose another file name instead of tivo-2.bak. Maybe hacked-2.bak instead. (if you have the space). Then you can play around and learn without fear of really hurting anything. You also have the option of the “original” TiVo drive if you took my advice. ;-)

Also note that you can only modify stuff in /var. Everything else is mounted Read-only by the TiVo. Besides, even if you did, since we are running an unmodified system, the TiVo would do away with any changes at boot time.

Have fun, and Good Luck!


Last edited by Ingineer on 12-31-2002 at 12:06 PM

[dogbreath]

Has anyone been able to install an editor on the HDVR2?

[Ego]

I've been hacking TiVos for years now, but I'm never the guy who comes up with the methods, I'm the guy who says "Aha, they got it working, time to implement it". So I changed over from two Sony SVR-2000 units to two HDVR2 units a few months back. I remember following the thread on tivocommunity.com about hacking these guys, but the last time I checked, it required you to socket your PROM, then get a new PROM chip that is flashable, then do all the hack stuff, AND you had to have a specific version of the TiVo software installed (an older version).

After reading this how-to, it makes no mention of requiring an older version of the tivo software, and certainly doesn't talk about changing the PROM and such. Have these requirements been alleviated? I was holding off on hacking my units because they're both doing full-time duty, and I didn't want to have to start soldering and mucking with the innards of either of these. I have tons of saved recordings too, so reverting to an older version of the software (I know for a fact both units have a newer version than what was required, according to the tivocommunity.com thread I was reading) is out of the question.

So am I to understand that anyone with an HDVR2, regardless of what version of the TiVo software is on it, can do these steps and successfully get bash back, and more importantly, tivoweb? I've been dyyyyyyyyyyyyying to get tivoweb back, so this would, as they say, "make my day".

Any clarification on these points?

[mrblack51]

Originally posted by Ego
After reading this how-to, it makes no mention of requiring an older version of the tivo software, and certainly doesn't talk about changing the PROM and such. Have these requirements been alleviated?

reverting to an older version of the software is out of the question.

So am I to understand that anyone with an HDVR2, regardless of what version of the TiVo software is on it, can do these steps and successfully get bash back, and more importantly, tivoweb? I've been dyyyyyyyyyyyyying to get tivoweb back, so this would, as they say, "make my day".

no offence, but did you even read the first post in this thread? the only bash_envable version of the tivo software for the hdvr2 is 3.1.U5. if you want to use another version, your only option is to perform the prom socket mod.

as with all the other tivos, regardless of whats on there now, you can restore an image of whatever

[Ego]

When you say "did you read the first post of this thread", well yes, I did, but this is a HUGE thread, and a lot could have changed since January, when that post was first made by yourself.

If you meant the first post in the how-to guide that was just posted, yes, I read that too, and it said he was BASING the instructions on the U5 version, it said nothing about REQUIRING the U5 version. That's why I asked.

Sorry to have bothered you.

[tivosohn]

MrBlack51,

I followed all the instructions I can find on this thread and other ones, but still couldn't find a solution. Anyway, here's my problem. I did everything as you posted on the first post of this thread. Then I plug the drive back into the dtivo, after I restarted the machine, I get the following message in my HyperTerminal:

Output enabled
Ram size = 64
Service number is 0000000000000. (real number appears)
What is password?


And on the TV it's stuck on the powering up screen. Any idea what I should check or any guesses on what I have done wrong? Any help will be GREATLY appreciated.

Thanks...

[txag93]

Make sure you didn't move any jumpers on the original drive, or if using a new drive, make sure jumpered for CS or master.

Finally, try disconnecting the serial port until you get to the almost there screen. I have seen a few instances where I got into that dialogue when my serial terminal was set for 115200 and I booted while connected. Not sure why, just some things to try.

Originally posted by tivosohn


Output enabled
Ram size = 64
Service number is 0000000000000. (real number appears)
What is password?

And on the TV it's stuck on the powering up screen. Any idea what I should check or any guesses on what I have done wrong? Any help will be GREATLY appreciated.

[tivosohn]

Super thanks for the tips, txag93. My problem was the combination of jumper and the serial cable, for some reason my HDVR2 doesn't like my WD 80GB's jumper set at "master". It likes it when I set it at "CS". Also, if I boot up the dtivo with the serial cable plugged in and set it at higher baud rate than 9600, it gives me that problem. Everything works fine and I got the bash if I set it to 9600 and CS.

thanks.

[Michigan1]

OK, I've been working on my mod and all has gone extermely well until I try and do this:



Did you modify your rc.sysinit?


in your hackinit you should be doing this...

# replace rc.sysinit with modified copy
rm -rf /etc/rc.d/rc.sysinit
cp /var/hack/rc.sysinit /etc/rc.d/rc.sysinit


copy rc.sysinit to /var/hack and comment out the references to software upgrades... Your box will download em and then throw em away... Would be nice to keep em from downloading completely, but for now this works...





Whn I go to my etc/rc.d folder I only find two files:
rc.S and rc.inet1.


No rc.sysinit????? ANY THOUGHTS?

[mrblack51]

Originally posted by Michigan1
Whn I go to my etc/rc.d folder I only find two files:
rc.S and rc.inet1.

No rc.sysinit????? ANY THOUGHTS?

i am assuming you are using the boot disk. if you start out in root (/) and then cd etc/rc.d, then you will get the bootcd's rc.d folder. if you mount your tivo partition as /mnt, you need to do a cd /mnt/etc/rc.d

[Michigan1]

MrBlack-

OK, that was also my first thought...let me go into more detail.

I boot from disk. I only have the tivo drive attached.....

If I mount /dev/hdd /cdrom and then cd /cdrom and go into the etc folder I see the two files (That would be on the CD obviously)

I then mount my drive by:

mount /dev/hda9 /mnt/tivo

I can then cd to mnt/tivo and see another etc folder (along with others) if I cd into the etc folder and do ls I see nothing. If I cd from the mnt/tivo to my hack folder I can see/edit my files with no problem.

I determined the mount for hda9 by doing the bootpage -p /dev/hda


Do I need to be going to another partition or ?

TIA!!!!!