Page 3 of 13 FirstFirst 12345 ... LastLast
Results 31 to 45 of 188

Thread: Tips for 4.0 on your S2 DTivo

  1. #31
    Join Date
    Sep 2002
    Posts
    46
    I haven't tried these yet but I seen different printf's posted here 4.01 and 4.0

    4.01
    printf "\x24\x02\x00\x01" | dd conv=notrunc of=tivoapp bs=1 seek=08300072

    4.0
    printf "\x24\x02\x00\x01" | dd conv=notrunc of=tivoapp bs=1 seek=8275016 {credit to MuscleNerd}

  2. #32
    Join Date
    Sep 2002
    Posts
    46
    Does 4.x have any special security regarding network connections to the home office. Is there special encrypted handshake or something?
    Would it be hard to fool my HDVR2 into thinking it was talking to the home office but instead talking to my laptop or another computer?

  3. #33
    Join Date
    Jun 2001
    Posts
    3,108
    Originally posted by hpmailman
    Does 4.x have any special security regarding network connections to the home office. Is there special encrypted handshake or something?
    Would it be hard to fool my HDVR2 into thinking it was talking to the home office but instead talking to my laptop or another computer?
    eh? are you talking about HMO or about telnet and such?

    if HMO, you won't be able to get HMO working on your HDVR2 as of now. in the future, maybe...but not now. yes, i believe the tivo limits the connection to local lan tivos. you could fool the tivo by setting up a VPN connection between the two networks, so the remote stuff would see themselves as on the local network.

    if you aren't talking about HMO, then VPN should work. im not sure what you are trying to do
    Step one: search button!
    Silly Wabbit, guides are for kids

  4. #34
    Join Date
    Sep 2001
    Posts
    459
    Yep, it seems the 2 byte patch is working. I found my error whatever problem. An attempt at inserting a program into the unit was the responsible party. The nowplaying structure is different, and it bascially pissed the unit off. It fixed right up and can record fine after I pulled that partial from the DB. You can't use the current mfs_ftp to import programs if anyone else wasn't aware, like I wasn't aware. Good news is that it seems with some minimal changes, it should work.

    Bad news for those like me that hate the peanut remote, the constants that used to govern the remote don't seem to do much of squat. All the IR codes are there as far as I can see, I just can't find the toggle to let the Sony remote work. I'm almost a third through mapping out the constants, hoping to get lucky, or I'm going back to 3.1.1b.

    Originally posted by NutKase
    Worked fine when I was on 4.0, let me know how it goes.

    NutKase

  5. #35
    Join Date
    May 2002
    Posts
    314
    Originally posted by hpmailman
    I would like to imitate the Tivo server. Have my HDVR2 call into my PC using the network.
    The service connection itself makes no use of encryption or any other security features. So obviously, one of the quicker approaches would involve snooping the network during a legit connection to see what goes back and forth.

    Note that some things that the service can send your box do require cryptographic signature checking. But much of what you can do doesn't involve that.

  6. #36
    Join Date
    Sep 2001
    Posts
    459
    I haven't looked into the patches, but here is a script that will change the backdoor code to T1V0.
    Attached Files Attached Files

  7. #37
    Join Date
    Jun 2001
    Posts
    3,108
    Originally posted by Juppers
    I haven't looked into the patches, but here is a script that will change the backdoor code to T1V0.
    when i tried this, the backdoor code was different. i had to modify the script to use the backdoor code hash that i had.
    Step one: search button!
    Silly Wabbit, guides are for kids

  8. #38
    Join Date
    May 2002
    Posts
    314

    Re: host file?

    Originally posted by nata2
    What address does the 4.0 tivo make a service call to? can we just spoof the DNS by throwing a hosts file entry into the /etc dir on the box
    The service call is made using an IP address directly, not a hostname -- so a hosts file entry wouldn't be useful.

    Your logs should show that the IP address is 204.176.49.2, which is inside a UUNET domain. If you wanted to filter out that entire block of addresses, the CIDR is 204.176.0.0/14.

  9. #39
    Join Date
    Jun 2001
    Posts
    3,108
    for those trying to get tivoweb up and going on your hdvr2 running 4.0, http://www.dealdatabase.com/forum/sh...Old#post119780 has some good info. the main thing you need to do in addition to the info mentioned there is to add "230" to the place in http-tt.tcl that is setting the dtivo variable. i ended up renaming phone.itcl because it was giving an error.

    edit: this info is deprecated. tivowebplus fully supports 4.x. this stuff only applies to tivoweb 1.9.4
    Last edited by mrblack51; 08-08-2004 at 01:59 PM.
    Step one: search button!
    Silly Wabbit, guides are for kids

  10. #40
    Join Date
    Aug 2003
    Posts
    2,149
    Originally posted by mrblack51
    when i tried this, the backdoor code was different. i had to modify the script to use the backdoor code hash that i had.
    I don't suppose you have any idea what the hash is for 4.01? What direction should I take for finding it?

    NutKase

    [EDIT] I got this and no hash back when I ran it. I think it's Resource Group related. I never get any resource info from tivoweb either.
    -----------------------------------------------------
    bash-2.02# ./backdoor4.0.tcl
    no such object:
    while executing
    "dbobj $tmpres get "String""
    invoked from within
    "transaction {
    set swsysa [db $db open "/SwSystem/ACTIVE"]
    set resgrp [dbobj $swsysa get ResourceGroup]
    set tmpgrp [lindex $resgrp 1]
    set tmpres [linde..."
    (file "./backdoor4.0.tcl" line 7)
    bash-2.02#
    Last edited by NutKase; 11-12-2003 at 10:04 PM.
    "God, and DealDataBase, help those that help themselves." --Shamelessly stolen from psxboy
    ------------------------------------------------
    2 each, SA S2 287hr 7.2.1a's with Lifetime.
    Hacks: 1 Manually Monte'd -140, Bash,Telnet,FTP,TivoWebPlus,
    Superpatch-67all Unscrambled/HMO,MFS_FTP Ver. N,TyTools, tivoserver
    Fully hacked SA S1

  11. #41
    Join Date
    Jun 2001
    Posts
    3,108
    Originally posted by NutKase
    I don't suppose you have any idea what the hash is for 4.01? What direction should I take for finding it?

    NutKase
    when you ran the script, what did it say? when i ran it, the script indicated what hash it found. i just took the one it spit out and plugged that into the script
    Step one: search button!
    Silly Wabbit, guides are for kids

  12. #42
    Join Date
    Sep 2001
    Posts
    459
    Yeah, I didn't actually compare the hash, I had already hunted it down and replaced it by hand long before moding that script with the correct resource location. For those that understand what they are doing, they can remove the validation check so it just sets the new hash. I'm not going to explain how, because it isn't really bright to blindly replace things.

    Anyhow, my time with 4.0 is over until I figure out how to get my remote to work with it. Can't stand the peanut.

  13. #43
    Join Date
    Jun 2001
    Posts
    3,108
    I was able to get mfs_ftp going for extraction on 4.0 on my s2. as with tivoweb, you need to edit the tzoffset.tcl file in a similar fashion to ensure that the script counts the unit as an 3.x dtivo, and make sure to get rid of the TimeZoneOld stuff.

    I made similar edits to the NowShowing.tcl of tytools, but i am still getting the following error. i will try to track it down, but if others have ideas, let me know:

    Code:
    SERVER: We got a message! buf = 'SHOWING'
    InitializeProgramOrDie failed: 0x190001
    on the tytools side, it says "Sorry.. Could not obtain the list."

    update: by using musclenerd's archive of the tyserver stuff, i got it working. the problem above was a somewhat unrelated mempool issue. after a reboot, it worked fine.
    Last edited by mrblack51; 11-14-2003 at 12:14 PM.
    Step one: search button!
    Silly Wabbit, guides are for kids

  14. #44
    Join Date
    Jun 2001
    Posts
    3,108
    Originally posted by Zyll
    I used Sleeper's script to set up Monte and install the hacks - everything seemed OK, but after playing around with mfs_ftp I'm getting "internal error 86" whenever I try to record (some kind of corruption in the todo list?). "clear all" doesn't fix it. I think that it probably happened after trying to insert, but these aren't well controlled experiments!

    I'm going to start over, and try to figure out exactly what caused the problem this weekend.
    i got an error 86 after some wierdness upgrading my gxcebot to 3.1.0b manually. it was cleared by doing a C & D todo list from the tivo menus. some have mentioned that extraction works on 4.0, but insertion currently doesn't, and can cause corruption of the mfs
    Step one: search button!
    Silly Wabbit, guides are for kids

  15. #45
    Join Date
    Mar 2002
    Posts
    99

    Tivo Service Emulator

    Sequence for communication with the mothership:

    204.176.49.2/tivo-service/mlog.cgi
    (uploads svclog)
    204.176.49.2/tivo-service/TCD411.cgi
    (checks for new phone numbers)
    204.176.49.2/tivo-service/HServer.cgi
    (checks for new slices, ice.bnds, snow.bnds, etc. Sets parameters for subsequent communications including the location of the keyserver)
    204.176.49.4/keyserver.cgi
    (updates keyring for HMO keys, etc)
    204.176.49.2/tivo-service/mlog.cgi
    (uploads download status)
    Last edited by mrblack51; 11-14-2003 at 06:24 PM.
    -- Dennis

    100 Hr Series 2 (development) Lifetime
    120 Hr Series 2 DTiVo (mine) Zipper-ed
    120 Hr Series 2 DTiVo (wife's) Zipper-ed
    120 Hr Series 2 DVD-RW (wife's) unhacked

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •