How to disable tystream encryption to enable extraction

[Sleeper]

Thanks guys for all of the insight. My question is, this seems to work for 3.1.1* and 4.0 however, it makes no mention of 3.1.U5.
Thanks in advance for the help
Erick

You are correct! This is not the forum to be asking these questions. Many of us read the newbie forum. Please repost in the newbie forum and edit/delete your above post.

ANY modification to ANY of the system files (such as is done by this enhancement) WILL NOT WORK with the BASH_ENV method that you are using. I strongly recommend that you move to monte.

Again, please respond in the newbie forum and respect the continuity of this thread.

[Sleeper]

For those who want to know the patch location for the S2 3.1.0-01-2.151 version of tivoapp, the patch is

echo -n "\x3C\x02\x00\x00" | dd conv=notrunc of=tivoapp bs=1 seek=6484124

Is the original value that is being replaced the same as the other versions?
\x03\x20\xf8\x09

Thanks,

S.

[nobody]

Sleeper:

Yes, the original bytes are 03 20 F8 09.

I have only done some very limited testing following the patch.

1. Patch tivoapp, reboot.
2. Attempt to playback of prior recording elicits an error.
3. Ciphercheck confirms that all prior recordings have no encryption but their CSO are set.
4. Csoscout nulls the CSO on all prior recordings.
5. Playback runs fine.
6. Make a small recording.
7. Check with ciphercheck that the latest recording and all prior recordings have no encryption and their CSO unset.
8. Playback is fine with the new and old recordings.

I haven't tested the extraction and reinsertion, or transfer of the recordings between Tivos of the same (S2 to S2) or different generations (S2 to S1).

[dancewithmice]

This looks like a great simple easy no encryption patch. Just one question. Does it offer any advantages over the KMEM patch? I have two units running sleepers tivoscripts, and put this noscramble patch on one. It works great, but I don't see any advantage over KMEM or any reason to modify my other unit to this method. Since the instructions say to remove any KMEM or other noscramble methods first, it looks like there might be some reason to switch from other methods to this method.

Are there advantages I don't know about?

[BTUx9]

Are there advantages I don't know about?

One advantage I see is that the streams created with the patched tivoapp are universal... because the CSO keys aren't there, non-scrambled streams will run on machines with the patch, kmem, or even ones with no unscrambling set up. Kmem streams will only run on tivos that have kmem (or noscramble.o) running, unless you nuke the CSO key first.

[TheWickedPriest]

Put simply, it's just more elegant. The end result is the same.

[jdmarsh04]

I don't know if this has been answered before, but I haven't seen it anywhere yet. I am running this system:

DirecTV Tivo Series 1 (Philips DSR6000R)
3.1.0b software
tivoapp hack to turn off scrambling (never installed noscramble or kmem, etc)

I can pull off ty files from recording after I didn't the tivoapp hack, but not before since they were scrambled. I grabbed the unscramble.o tarball and placed it on my tivo. I untar the file by using 'cpio -idu -H tar < unscramble.tar'. (I don't seem to just have the tar command on my tivo) I run 'insmod unscramble.o' and don't get an error, just the command prompt back on my telnet screen. I run the episode I want to pull off for 10 or more seconds. Then I stop the recording and try to pull the ty file off my tivo via TyStudio, but I continue to get the error in tystudio that says it doesn't get the okay message: Error 400 and the downloading bar on tystudio sticks at 0% forever.

I can't figure out what I am doing wrong. Is there something I am missing?

In the readme file inside the unscramble tarball, it mentioned that if unscramble.o is loaded, you shouldn't be able to see the new unscrambled shows, but I can still see them, which makes me believe I haven't loaded the unscramble.o correctly.

I am stuck, please help!

[Michael M]

I have a series 1 - T60

Once I implement the patch introduced by AlphaWolf - do I need to run unscramble.o anymore?

[wierdo]

For those who want to know the patch location for the S2 3.1.0-01-2.151 version of tivoapp, the patch is

echo -n "\x3C\x02\x00\x00" | dd conv=notrunc of=tivoapp bs=1 seek=6484124

Perhaps I'm just dumb, but after verifying that that location does in fact hold the instruction we want to clobber, I went ahead and patched my tivoapp using this command line, and it caused my DSR7000 running 3.1.0 to go into a reboot loop (I can only assume because tivoapp wouldn't start, since I don't have a double female gender changer). After replacing tivoapp with the backup copy, it works again.

Has anyone else tried this patch on an S2 3.1.0?

EDIT: Dumb people like me forget that for echo to interpret the escape codes, one must include the 'e' option, as pointed out in the original post in this thread. Blind cut 'n paste is evil, however, not putting ASCII garbage in my tivoapp helped tremendously.

For other serial cut 'n pasters such as myself, the correct command line is:

echo -ne "\x3C\x02\x00\x00" | dd conv=notrunc of=tivoapp bs=1 seek=6484124

A correct application will have dd reporting that it wrote 4 blocks, not 16.

[a94cobra]

I am trying to mod a S1 with 3.0-01-1-000 software. I used the line: echo -ne "\x48\x00\x00\x38" | dd conv=notrunc of=tivoapp bs=1 seek=4678216 as described earlier in the thread for this unit. It boots all the way to the Tivo menu with "Now Showing" and "Watch Live TV" choices. If I leave it there all is fine. But when I go to Live TV, the unit reboots after about 2 secs.

I do have some recordings on the Tivo. None of them are really important. I was just gonna let them fall off as they got replaced with new stuff. With 60hrs recording space that shouldn't be that long. So I wasn't gonna worry about running any of the scripts to change the setting on those recordings beacuse they are not important.

What would cause the unit to reboot? Am I leaving out a step somewhere? The older recordings shouldn't be affecting anything should they, even if they are scrambled?

[vancod]

I don't know if this has been answered before, but I haven't seen it anywhere yet.
<snip>I can pull off ty files from recording after I (did) the tivoapp hack, but not before since they were scrambled. I grabbed the unscramble.o, <snip> but I continue to get the error in (trying to generate the key file)

Likewise - I have a Hughes S1 DTiVo and cannot seem to do anything with shows recorded prior to running the "unscramble hack" detailed in this thread. Prior to this hack I _did_ use unscramble.o - but I never left the module in place (of this I am certain), and all of my current recordings should be "as recorded by DTiVo" free of any outside influence/kernel module.

I have tried loading the unscramble.o module and then (playing the stream and) trying to pull them via both tytool and mfs_ftp - and in all scenarios when I go to gen the key file tytool just sits, or will occasionally puke entirely (WinXP). I tried to use the TCl script (CSOScout.tcl) but it won't run on my system - complaining about the 1st command in the script(EnableTransactionHoldoff true - "command not found"), as well as a couple more after that. cat and mfs_ftp are in my path.

So - what is the proper method for extracting usable video from shows recorded prior to this hack? Do I need to back out the hack, and pull the streams via the "standard" unscramble.o method?

Also - this hack shouldn't have _any_ effect on video quality should it? I am seeing some recordings starting to come across with a lot of "horizontal streaking" that I have not seen in extracted streams in the past. I can post examples if it's worth seeing....

Thanx
Don

[compwiz312]

I tried to use the TCl script (CSOScout.tcl) but it won't run on my system - complaining about the 1st command in the script(EnableTransactionHoldoff true - "command not found"), as well as a couple more after that.

Don, it almost sounds like the script is trying to run using bash instead of tivosh. Make sure the first line of the script contains

#!/tvbin/tivosh

and not

#!/bin/bash or #!/tvbin/tivoshM

. Check this using joe or cat on the Tivo. Alternatively, you can type the following command

cat CSOSCout.tcl | dd bs=1 count=500

if it scrolls by too fast for you.

See if this fixes your problem. If it says #!/tvbin/tivoshM, then it means that you need to run dos2unix on the script (search google) before you upload it to the Tivo as it was done in DOS format, not Unix format.

Enjoy.

[stevel]

So - what is the proper method for extracting usable video from shows recorded prior to this hack? Do I need to back out the hack, and pull the streams via the "standard" unscramble.o method?

You do not need to back out the hack. You do need to insmod unscramble.o and play a few seconds of the show you want to extract. Then you can extract it. I used mfs_ftp and the ty+ format, I had problems using tmf for such purposes (at least when re-inserting on another DTiVo, but if you want to burn to DVD, then any of the usual methods should work.)

There is no effect on the picture quality that I am aware of (and I can't see how there would be.)

[vancod]

You do not need to back out the hack. You do need to insmod unscramble.o and play a few seconds of the show you want to extract. Then you can extract it. I used mfs_ftp and the ty+ format, I had problems using tmf for such purposes (at least when re-inserting on another DTiVo, but if you want to burn to DVD, then any of the usual methods should work.)

I've tried that - inserting the module, playing the stream, then pulling via either tytool or mfs_ftp (in both .ty and .ty+) gets me the same results for both. I want to run the tcl script because I think that might help clear the CSO stuff up for me if it's mucked - I know that the header of the file calls tivosh, and have looked for hidden characters with vi and it looks fine to me (albeit on a local linux box) - so I'm puzzled. I suppose that it might have been mucked in xfer to the box, I will check when home. FWIW - I can't get joe to run on my DTiVo either - it just hangs after loading the file, and "less" is giving me library errors - so I may have some pathing issues or something else afoot on my DTiVo. My hacks were installed via the CD that came with Keegans book + a few newer files.

There is no effect on the picture quality that I am aware of (and I can't see how there would be.)

Yeah - I didn't think so but I just wanted to throw that out there. I've been archiving "Uranium Classics" off FUSE and have only started to see this video artifacting since running this hack. It may just have been a bad day for satellite signal..... winter in NE Ohio.

Thanx all -
Don

[stevel]

Don,

Well, I also used Keegan's CD and haven't had these problems. I'm guessing you have something fundamentally wrong with the software setup. You may want to try starting over from Keegan's CD and making sure the basic stuff (such as vi and less) work properly. Then progress to the more advanced stuff.

I never got the CSO TCL script to work but stopped trying when I had success in extraction/insertion. I'm using DSR6000s - what TiVo type do you have?