tivoapp patches

[RandC]

anyone have any suggestion how to find this in 9.4 i searched in a hex editor and there are multiple locations with 10400007 hex in the tivoapp file.

thanks

Not the proper way but, add code before or after known patch location and search in new tivoapp to try to locate same code. I would love to know what software and process tivo4mevo uses to locate patch locations.

[jt1134]

anyone have any suggestion how to find this in 9.4 i searched in a hex editor and there are multiple locations with 10400007 hex in the tivoapp file.

thanks

Searching for the original hex data from 4.x/5.x in a 9.4 tivoapp isn't very likely to work at all. tivoapp has gone through some considerable changes since then, tivo uses a different compiler, and patches can't be ported that easily except in the case of minor sw revisions like 9.4 to 9.4b (at least not just by a simple hex compare). You'll need to identify the actual function that's being patched in 4.x and the logic used by the patch to cause the desired effects. Then if you can find a similar function in 9.4, you can translate that logic to the new function. Not a very trivial task until you brush up on a bit of mips assembly.

Start reading here, here, and of course, here.

[tivo4mevo]

To echo what jt said, I think you'll have trouble by trying to port the patch using a hex editor.

With the disasssembly, you can match the strings (which have remained largely the same) surrounding the patch. Doing so would arrive at this patch

All Values are Hex

Sw Version      Offset (VMA)     Original Value    New Value
9.4             0x00714030       10400008          10000008
11.0d           0x007c5a3c       10400008          10000008
11.0h           0x007c5c20       10400008          10000008

Not tested, but tracing around a bit, it looks like it should do the trick. For reference, this patch avoids the "pending restart" and nightly reboot after you've received, but not installed, a new software upgrade. See this post here (link) for more details and warnings.

[lgkahn]

well mine is not rebooting every night but it is getting pending reboot.. here is what i got thanks for your help will test tonight

# !/tvbin/tivosh
# Sw Version Offset (VMA) Original Value New Value
# 9.4 0x00714030 10400008 10000008
# -400000 from vma to get hex offset then convert to decimal to get seek
echo -ne "\x10\x00\x00\x08" | dd conv=notrunc of=tivoapp bs=1 seek=3227696

[lgkahn]

ok the test on one of my s3 units last night was sucessfull.. call was logged as sucessfull and guide to date changed to jan 4 and no pending restart.. will see how long it lasts my guess is as someone previously mentioned in the other thread till the cert. i got when the 11.0 download happended expires.. but then maybe i will have to upgrade to 11.0 which is on the box.. hopefully by then someone will have worked out the issue why mfs_ftp no longer works for insertion on 11.0.. thanks now i will apply the patch to my 2nd s3.

[bengalfreak]

I used this command to patch my 6.2a tivoapp to turn the clock on automatically at reboot. It seems correct to me, but it didn't have any apparent effects whatsoever. I got 4 records in, 4 records out as the resulting message. However, no clock. Anyone see any mistakes I made in the command.

echo -ne "\x14\x40\x00\x07" | dd conv=notrunc of=tivoapp bs=1 seek=4657720

thanks...jeff


EDIT:

Nevermind, I finally figured out how to use a Hex editor. Duh.

[Butch]

Allows live buffering and recording of XM Music channels, for tivoapp version 6.1a (6.2a is also the same)

Offset(VMA)      Orig      New
0x0087421C 50400009 10000009
0x0087425C 10400199 00000000
0x00BE797C 93a20018 00001021

I hate to ask this because I know I asked it a few times along time ago.
Does any have this for 6.3e software

[jt1134]

Here are a few tivoapp patches that can be used instead of fakecall.tcl. These patches prevent a dtivo from dialing out to tivo, yet still report the call as being successful.

6.2a
0x00676734 "02001021 00001021"
0x0068145c "1600ff6e 1000ff6e"
0x006e34b0 "1040017d 1000017d"

6.4a
0x008f074c "02001021 00001021"
0x008f5eac "1440fff1 1000fff1"
0x00c3ebb8 "10400140 10000140"

These patches take into account the 2 types of calls to tivo, phone and network, and block both of them. The 2 calls are handled differently by tivoapp, thus there are a few patches. For a number of reasons, it's a good idea to target both of these calls. You could use the old 'route' trick in rc.sysinit.author or play some games with your router to block these calls, but that's not as fun as hacking tivoapp

The patch at 0x00c3ebb8 causes a call by phone to fail while checking for a dial tone.

The patch at 0x008f5eac causes a call by network to hang up as soon as it starts.

The patch at 0x008f074c causes the tivo to not give a damn what happened during the call and just report everything as "successful."

Apply all 3 patches and there will be no "Daily Call" nags, no downloading of showcases/ads/etc from tivo, and no tcl script/cron/reboot kludges to deal with.

[RandC]

Here are a few tivoapp patches that can be used instead of fakecall.tcl. These patches prevent a dtivo from dialing out to tivo, yet still report the call as being successful.

Excellent work. Even with fakecall some where down the line it gets messed up and I start getting the nags again. Will apply the patches and be thankful of your work understanding the tivoapp.

[tivo4mevo]

Cool patches!

[tvtyme]

I hate to ask this because I know I asked it a few times along time ago.
Does any have this (live buffering and recording of XM Music channels) for 6.3e software

Yup, here.

[tvtyme]

jt1134, for some reason the fakecall tivoapp patch crashes my Tivo (HDVR2 running 6.4a w/Tivo Wireless G NIC) when I either set it use the Network for daily call (where it would test the connection first) or made an actual call. I'm running elseed for caller-id (hence the "Modem: OK" and "Caught Signal" messages).

#:/var$ Caught signal, standby while exiting... (signo=14)
Modem: OK
Caught signal, standby while exiting... (signo=14)
Modem: OK
Modem: OK
Caught signal, standby while exiting... (signo=14)
Modem: OK
Modem: OK
Caught signal, standby while exiting... (signo=14)
Modem: OK
Modem: OK
emulate_load_store_insn: sending signal 10 to tcphonehome(358)
$0 : 00000000 80160000 00230003 aaaaaaaa aaaaaaaa 00000001 7fc7f1a0 00000000
$8 : 0000fc00 ffffdfff 00000000 00000001 8347f13c 7fcff640 00001ce7 80196004
$16: 5efca7d8 5efca7b0 7fc7f318 7fc7f370 00000000 5efc8000 00000001 5efc8000
$24: 00000000 0240e6e0                   2ac1c1f0 7fc7f288 7fc7f348 00929ee4
Hi : 00000000
Lo : 00000014
epc  : 00929ef0    Tainted: P 
Status: 8001fc13
Cause : 00000010
       8001f950 8001f96c 80023b94 8002270c 8002248c 8001e17c 
       00929ef0 00927f00 00c3d000 008f63c0 008f5ffc 008f061c 008f0244 008efdc4
       008ef384 0096c224 00472f14 00f3f7b4 02a2871c 02a304bc 02a298cc 02a28a48
       02a28834 02a6069c 02a2871c 02a28630 02a2b03c 02a3c684 02a3c56c 02a3c41c
       02a3b978
Tmk Fatal Error: Activity DialRequest <358> strayed!
pc 0x929ef4 status 0x8001fc13 cause 0x000010 bva 0xaaaaaab6 hi 00000000 lo 0x000014
R00 0x00000000  R01 0x80160000  R02 0x00230003  R03 0xaaaaaaaa  
R04 0xaaaaaaaa  R05 0x00000001  R06 0x7fc7f1a0  R07 0x00000000  
R08 0x0000fc00  R09 0xffffdfff  R10 0x00000000  R11 0x00000001  
R12 0x8347f13c  R13 0x7fcff640  R14 0x00001ce7  R15 0x80196004  
R16 0x5efca7d8  R17 0x5efca7b0  R18 0x7fc7f318  R19 0x7fc7f370  
R20 0x00000000  R21 0x5efc8000  R22 0x00000001  R23 0x5efc8000  
R24 0x00000000  R25 0x0240e6e0  R26 0x00000000  R27 0x00000000  
R28 0x2ac1c1f0  R29 0x7fc7f288  R30 0x7fc7f348  R31 0x00929ee4  
Paste the following into a shell to get a backtrace...

bt -t /tvbin/tivoapp <<END_OF_BT
  tcd 1
  hpk Series2
  build b-6-4-prod @299218 2008.05.08-0010 release-mips []
  pack 6.4a-01-2
  read 0x00400000 /tvbin/tivoapp
  read 0x02000000 /lib/libc.so.6
  read 0x02200000 /lib/libm.so.6
  read 0x02400000 /lib/libpthread.so.0
  read 0x02600000 /lib/libutil.so.1
  read 0x02800000 /lib/libtvutil.so
  read 0x02a00000 /lib/libtmk.so
  read 0x02c00000 /lib/libtvstructures.so
  read 0x2aaa8000 /lib/ld.so.1
  read 0x2ab04000 /lib/libhpkoss.so
  read 0x2ab50000 /platform/lib/libhpkhl.so
  read 0x2ac18000 /platform/lib/libhpkll.so
  read 0x2ac5c000 /lib/libdl.so.2
  read 0x2aca0000 /lib/libcdaudio.so
  0x00929ef4 0x00927f00 0x00c3d000 0x008f63c0 0x008f5ffc 0x008f061c 0x008f0244 
  0x008efdc4 0x008ef384 0x0096c224 0x00472f14 0x00f3f7b4 0x02a2871c 0x02a304bc 
  0x02a298cc 0x02a28a48 0x02a28834 0x02a6069c 0x02a2871c 0x02a28630 0x02a2b03c 
  0x02a3c684 0x02a3c56c 0x02a3c41c 0x02a3b978 
END_OF_BT

Tmk Fatal Error: Activity DialRequest <358>: unexpected signal 10
flushing ide devices: hda 
Restarting system.

I went back to using fakecall and the "route" trick in rc.sysinit.author.

[jt1134]

here's a leaner fakecall patch that shouldn't mess with any of the actual modem functions

6.4a
0x008f04d8 "27bdff78 03e00008"
0x008f04dc "afb5007c 24020000"

[chris0583]

There a NOPPV patch for hr10-250 6.4a? I cant seem to find it after hours for searching.

[jt1134]

There a NOPPV patch for hr10-250 6.4a? I cant seem to find it after hours for searching.

why? I ported it once out of boredom...it doesn't do anything useful