30 Sec Skip

[chazman]

Is there another way to permanently enable the 30 sec skip on the HDVR2 other than with tivoweb installed.

Seems Musclenerd made a patch for the series 1 tivoapp, I was wondering if anyone worked on it for the series 2. I have been looking for the function. But it is a pretty big file.

Anyone have any insight.

Chaz

[Sleeper]

It would be cool if we could also find the location to patch for the directory sort option.

Although the sendkey scripts work, they are a round about way of doing things.

I assume you have disassembled tivoapp. What disassembler did you use. I might want to take a poke at it. I really need another S2 just for hacking.

[tmesis]

This thread may help:

http://dealdatabase.com/forum/showth...threadid=27553

I am working on a MIPS disassembler right now.

[chazman]

I have been using the IDA pro disassembler in the Windows environment.

[MuscleNerd]

In 3.1 the relevant instruction is at
713bc4: 10400024 beqz v0,0x713c58

You want to change that beqz instruction to a bnez. So, replace the 0x10400024 with 0x14400024:
713bc4: 14400024 bnez v0,0x713c58


In the tivoapp binary, address 0x713bc4 corresponds to offset 0x313bc4.

The patch doesn't "permanently" enable 30-sec skip mode. It just makes it default to "on". It can still be toggled via the SPS code.

[chazman]

That was easy. Too easy with the tip from MuscleNerd. Thank you.

For some reason my disassembly did not show the instructions down that far. They were all just listed as words. I probably have my disassembler in IDA setup wrong. Does anyone that uses IDA to look at the TIVO series two MIPS files have a list of the appropriate settings. Such as Big Endian, Mips PRO disassembler, etc..

Thanks again MuscleNerd,

Chaz

[sibarys]

Is there another way to permanently enable the 30 sec skip on the HDVR2 other than with tivoweb installed.

chazman,

do you know of a way to do it WITH Tivoweb installed?

Thanks.
Sibarys

[David Bought]

Originally posted by chazman
That was easy. Too easy with the tip from MuscleNerd. Thank you.

For some reason my disassembly did not show the instructions down that far. They were all just listed as words. I probably have my disassembler in IDA setup wrong. Does anyone that uses IDA to look at the TIVO series two MIPS files have a list of the appropriate settings. Such as Big Endian, Mips PRO disassembler, etc..

Thanks again MuscleNerd,

Chaz

Yes. Press the "C" key when you are on top of code, and it will disassemble it as code instead of listing it as words. Simple.

[TheWickedPriest]

Originally posted by MuscleNerd
The patch doesn't "permanently" enable 30-sec skip mode. It just makes it default to "on". It can still be toggled via the SPS code.

Sweet. Any other cool 1-bit (or more) patches for tivoapp?

[MuscleNerd]

Speaking for myself only, the only others that I've released are: one that permanently enables backdoor mode; one that permanently disables yellow-star promotions. I also had one that revived the Teach TiVo menu, but none of the Teach TiVo logic was actually implemented anymore

[TheWickedPriest]

Yeah, you mentioned on TivoCommunity that you'd posted the yellow star hack there, and it had been deleted. Could you post it here? Pleeease? :-)

[MuscleNerd]

Actually, it's a banned topic over there now but they were too lazy to go back and remove the original posts. So the PPC patches are still available over there.

[TheWickedPriest]

What about MIPS?

[ronnythunder]

thanks to musclenerd's and tmesis' original findings..

the offset for 3.1.1b is:

0x00714454  10400024  beqz v0,0x007144e8

same drill as before, just with a different address.

verified.

ronny

edit by mrblack51: please avoid the 'HDRV3' references, they will confuse people.

[ronnythunder]

Originally posted by ronnythunder
edit by mrblack51: please avoid the 'HDRV3' references, they will confuse people.

we've gotta educate them sometime!

for those who *are* confused: the 3.1.1b software load "changes" the model name of the hdvr2 to "hdvr3". this is similar to the change for the series 1 hughes boxes when they went from single to dual tuner (gxcebot -> gxcebotd).

in a way, it's actually a convenient way to show whether you've received 3.1.1b.

ronny