Page 1 of 3 123 LastLast
Results 1 to 15 of 37

Thread: 30 Sec Skip

  1. #1
    Join Date
    May 2003
    Posts
    25

    30 Sec Skip

    Is there another way to permanently enable the 30 sec skip on the HDVR2 other than with tivoweb installed.

    Seems Musclenerd made a patch for the series 1 tivoapp, I was wondering if anyone worked on it for the series 2. I have been looking for the function. But it is a pretty big file.

    Anyone have any insight.

    Chaz

  2. #2
    Join Date
    Aug 2003
    Posts
    1,285
    It would be cool if we could also find the location to patch for the directory sort option.

    Although the sendkey scripts work, they are a round about way of doing things.

    I assume you have disassembled tivoapp. What disassembler did you use. I might want to take a poke at it. I really need another S2 just for hacking.

  3. #3
    Join Date
    Jul 2003
    Posts
    35
    This thread may help:

    http://dealdatabase.com/forum/showth...threadid=27553

    I am working on a MIPS disassembler right now.

  4. #4
    Join Date
    May 2003
    Posts
    25
    I have been using the IDA pro disassembler in the Windows environment.

  5. #5
    Join Date
    May 2002
    Posts
    314
    In 3.1 the relevant instruction is at
    713bc4: 10400024 beqz v0,0x713c58

    You want to change that beqz instruction to a bnez. So, replace the 0x10400024 with 0x14400024:
    713bc4: 14400024 bnez v0,0x713c58


    In the tivoapp binary, address 0x713bc4 corresponds to offset 0x313bc4.

    The patch doesn't "permanently" enable 30-sec skip mode. It just makes it default to "on". It can still be toggled via the SPS code.

  6. #6
    Join Date
    May 2003
    Posts
    25
    That was easy. Too easy with the tip from MuscleNerd. Thank you.

    For some reason my disassembly did not show the instructions down that far. They were all just listed as words. I probably have my disassembler in IDA setup wrong. Does anyone that uses IDA to look at the TIVO series two MIPS files have a list of the appropriate settings. Such as Big Endian, Mips PRO disassembler, etc..

    Thanks again MuscleNerd,

    Chaz

  7. #7
    Join Date
    Jan 2003
    Posts
    39

    ...What about WITH Tivoweb installed?

    Is there another way to permanently enable the 30 sec skip on the HDVR2 other than with tivoweb installed.
    chazman,

    do you know of a way to do it WITH Tivoweb installed?

    Thanks.
    Sibarys

  8. #8
    Join Date
    Jul 2003
    Posts
    973
    Originally posted by chazman
    That was easy. Too easy with the tip from MuscleNerd. Thank you.

    For some reason my disassembly did not show the instructions down that far. They were all just listed as words. I probably have my disassembler in IDA setup wrong. Does anyone that uses IDA to look at the TIVO series two MIPS files have a list of the appropriate settings. Such as Big Endian, Mips PRO disassembler, etc..

    Thanks again MuscleNerd,

    Chaz
    Yes. Press the "C" key when you are on top of code, and it will disassemble it as code instead of listing it as words. Simple.

  9. #9
    Join Date
    Jul 2003
    Posts
    522
    Originally posted by MuscleNerd
    The patch doesn't "permanently" enable 30-sec skip mode. It just makes it default to "on". It can still be toggled via the SPS code.
    Sweet. Any other cool 1-bit (or more) patches for tivoapp?

  10. #10
    Join Date
    May 2002
    Posts
    314
    Speaking for myself only, the only others that I've released are: one that permanently enables backdoor mode; one that permanently disables yellow-star promotions. I also had one that revived the Teach TiVo menu, but none of the Teach TiVo logic was actually implemented anymore

  11. #11
    Join Date
    Jul 2003
    Posts
    522
    Yeah, you mentioned on TivoCommunity that you'd posted the yellow star hack there, and it had been deleted. Could you post it here? Pleeease? :-)

  12. #12
    Join Date
    May 2002
    Posts
    314
    Actually, it's a banned topic over there now but they were too lazy to go back and remove the original posts. So the PPC patches are still available over there.

  13. #13
    Join Date
    Jul 2003
    Posts
    522
    What about MIPS?

  14. #14
    Join Date
    Sep 2001
    Location
    West of Bermuda
    Posts
    1,021
    thanks to musclenerd's and tmesis' original findings..

    the offset for 3.1.1b is:
    Code:
    0x00714454  10400024  beqz v0,0x007144e8
    same drill as before, just with a different address.

    verified.

    ronny

    edit by mrblack51: please avoid the 'HDRV3' references, they will confuse people.
    Last edited by mrblack51; 10-15-2003 at 10:36 AM.

  15. #15
    Join Date
    Sep 2001
    Location
    West of Bermuda
    Posts
    1,021
    Originally posted by ronnythunder
    edit by mrblack51: please avoid the 'HDRV3' references, they will confuse people.
    we've gotta educate them sometime!

    for those who *are* confused: the 3.1.1b software load "changes" the model name of the hdvr2 to "hdvr3". this is similar to the change for the series 1 hughes boxes when they went from single to dual tuner (gxcebot -> gxcebotd).

    in a way, it's actually a convenient way to show whether you've received 3.1.1b.

    ronny

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •