killhdinitrd 0.9.x Support Thread

[Cheezmo]

To compile on a Mac, change this line in the makefile:

 $(CC) -static -Wall -Wl,--strip-all -o $@ $^

to:

 $(CC) -Wall -o $@ $^

Thanks, that did it.

Now I'm in the middle of backing up my original drive to yet another 250Gb drive (I've got a 250+300 inside the Tivo).

I'm hoping I can run 'killhdinitrd /dev/rdiskn' where n is what pdisk shows as the location of my backup drive to patch it. If I get that far, I'll have to figure out how to get bash going from a Mac and then I'll probably be on my way (I hope!).

[saltydog4791]

OK, I too have compiled it for OS X but I still don't know where to begin. Can I use Sleepers disk and just bail out at a certain point and do the rest manually?

Sorry to be a PITA, but a $1K tivo and a $100 tivo are two different beasts entirely in my book.

saltydog4791

[MarkZ]

I've never tried this (but I'm very technical) so here's a first-timer's perspective on the changes.

Here's what I found while applying this to my Tivo...

STEP1 - Make a backup
If you can help it put the drive in a Linux box to avoid having Windows XP write a signature to the drive on an inadvertent Windows boot.

No matter what I couldn't mount the Tivo drive on my Redhat Fedora computer. I don't know why. So, I tried doing the mfstools backup routine and it gave no feedback and seemed to run forever with the recommended settings. Don't use -f9999 as that backs up all videos (and I had about 150GB of those).

Giving up on that as a backup mechanism, I was able to run dd to copy the drive. So, i did an entire bit-for-bit copy of the drive as a simple backup mechanism.

If you want to backup on a Windows PC you'll need to boot off one of the available boot CDs. I used an MFS Tools boot CD to attempt the backup the first time. If you do the copy that way make sure you enable DMA. To enable DMA on the drives...

hdparm -d1 /dev/hdb
hdparm -d1 /dev/hdc

The syntax for that is...

[with the Tivo drive as Secondary master, hence referred to as hdc (hard drive c) and the backup drive as Primary slave, hence hdb. So dd runs as...

dd if=/dev/hdc of=/dev/hdb

it took my computer (a not particularly stellar box) about 6 hours to make the copy during which time you get absolutely no feedback. You might try the bs option (blocksize) as I assume a larger than default blocksize would speed things up.

STEP 2 - run the patch
I then took the copy drive and tested it. After testing I booted with the MFSTools CD (the only way I could find to mount the drive). My Tivo (copy) was drive hdc (Secondary Master). I then ran killinitrd on the 6th partition

killinitrd /dev/hdc6

It printed some good things and proceeded to patch the kernel. I tried it on most of the other partitions and it refused to change any of them. Partition three it said was an unpatchable kernel (?). I powered down, removed the drive and tested it. It booted fine.

STEP 3 - Enable the USB for Ethernet

I have trouble believing the Sleeper ISO is what we want with a non-monte'd drive (a monte'd drive runs two different os versions). So I tried to enable the USB manually. To do this I had to again boot with the MFSTools CD. Once booted I mounted the Tivo hard drive at /mnt/tivo by typing

mount /dev/hdc7 /mnt/tivo

Partition 7 is most of the tivo stuff.

Once I could see the tivo stuff i created a file named /etc/rc.d/rc.sysinit.author. This file is run during the boot process.

I have a USB ethernet adapter so I copied the tivoftpd program to the tivo drive (/mnt/tivo/bin directory) and created the rc.sysinit.author file with the following contents:

insmod /lib/modules/usbcore.o
insmod /lib/modules/usb-ohci.o
sleep 10
insmod /lib/modules/pegasus.o

ifconfig eth0 192.168.0.19 broadcast 192.168.0.255 netmask 255.255.255.0

#Telnet and FTP
tnlited 23 /bin/bash -login &
tivoftpd

Once the file is created make it executable or nothing will run.

chmod +x rc.sysinit.author

I then unmounted and removed the hard drive (after powering down). My system booted but no ethernet that I could see (I have a Linksys USB200M and my assumption was that it used the Pegasus chipset. Now I'm stuck but will try more later...

M

[w2kr]

MarkZ,
The USB200M does not use the pegasus drivers. Try this in your author file:

#Load ax8817x ethernet drivers
insmod /lib/modules/usbcore.o
insmod /lib/modules/hcd.o
insmod /lib/modules/ehci-hcd.o
insmod /lib/modules/ax8817x.o

[ronnythunder]

If I produce this kernel by getting the Linux kernel source and applying the changes from the TiVo site and cross-compiling it for MIPS, will killhdinitrd work on that kernel or does the kernel have to be exactly the one shipped with the HD-Tivo?

no. as musclenerd (slightly indirectly) pointed out, the exploit will only work on a signed kernel. the kernel signature doesn't "cover" the entire kernel image, and the part that isn't checked is what's been changed. if you build a new kernel, it won't have a signature, and the prom will refuse to load the kernel.

ronny

[Cheezmo]

Got killhdinitrd compiled.
Backed up drive.
noted that /dev/rdisk1r6 had the partition we want. (Your mileage may vary!)

killhdinitrd spit out this...

fatal: short read on px header: Invalid argument

Looks like it can't read straight from the device.

So, I tried using dd to copy the partition to a file and ran killhdinitrd on the file (figuring I could dd it back when patched). That gave me...

That worked. So, I dd'd the modified partition back to the drive and it boots.

Now I guess I need a PC to actually install anything...

[Fletch319]

Unfortunately my attempts to add in support for the 4.0 kernel has failed. It's a bit more complex than I expected in the beginning. rc3105 suggested I post a request for help from some "kernel types" since they could probably do this in about 5 minutes. Anyone?? anyone?? It sure would be nice not to have to monte anymore with a hdvr2 running 4.0 (which seems to be more and more of the users now days due to the HMO superpatch).

[MarkZ]

To W2KR... thanks that was the right changes for the Linksys 200m. Now I have lights on the USB connector and the IP address pings from my home network! Yay.

I can telnet in just fine but at the moment FTP doesn't respond correctly so that's the next step...

M

[RxMan]

With a little bit of guidance via chat I was able to get the exploit running on my HD-Tivo. I used an mfstool boot cd and applied killhdinit. I then edited rc.sysinit.author and now have bash via ethernet connection. Basically, I am in.

Thanks HD TEAM and others!

[RxMan]

Well, I have bash via ethernet, but it wont accept any commands like ls or cd, etc... I'm not sure what is going on.

[Cheezmo]

You need to track down devbin [corrected]

http://tivoutils.sourceforge.net/

Now, where is vi...

[RxMan]

Do you mean "devbin-s2.tgz" from the link provided?
Where would all of those files need to go?

I tried to get serial bash and it fails. Still have bash via ethernet. I need to find a way to transfer files (first up would be tivoftpd).

[MuscleNerd]

Unfortunately my attempts to add in support for the 4.0 kernel has failed. It's a bit more complex than I expected in the beginning. rc3105 suggested I post a request for help from some "kernel types" since they could probably do this in about 5 minutes. Anyone?? anyone?? .

A port to 4.0 was provided to the powers-that-be already. I suspect it must now go through some round of verification before considering it for release.

[MarkZ]

Well, I seem to have everything working now. Here's the text to my rc.sysinit.author file...

#install usb and ethernet drives
insmod /lib/modules/usbcore.o
insmod /lib/modules/hcd.o
insmod /lib/modules/ehci-hcd.o
insmod /lib/modules/ax8817x.o
sleep 10

#configure ethernet
ifconfig eth0 192.168.0.19 broadcast 192.168.0.255 netmask 255.255.255.0
sleep 100

#telnet
tnlited 23 /bin/bash -login &

#ftp
/var/hack/tivoftpd.mips

#msf_ftp
/var/hack/mfs_ftp/mfs_ftp.tcl

I don't know if the sleep commands are specifically needed, and, of course, the usb/ethernet initialization and ifconfig commands are specific to my network and my ethernet card.

Things to keep in mind:

[1] the standard tivoftpd that comes with the MFSTools CD is not for a mips processor. You can get that one from http://tivo.stevejenkins.com/downloads/tivoftpd.mips . If you try to use the non-mips version you will get a "cannot execute binary program" error.

[2] telnet is fine but ls and ps are both missing. You can get them on-line. I found ls in a general mips compilation (see CheezMo's earlier post) and ps existed separately. I'm lazy and stuck both in the /bin directory (remount root as read-write, do the copy, remount as read-only).

[3] TivoWebPlus seems to install and run just fine using the .tpm it ships with. I put it in a /var/hack subdirectory and just ran the tpm to install it. If you autorun at startup it adds a few more lines to your .author file.

[Last] I can not get the video data unscrambled as yet. Checking the offset specified by Alphawolf for 3.1.5 with a hex editor shows that this is part of the string table and does not have the opcodes he's trying to null out.

MarkZ

[Cheezmo]

What are people's thoughts with regard to what might happen with killhdinitrd setups when future upgrades come down the pipe. On the surface it seems to me (and I'm no expert) that all that will happen is that it will switch kernels and all your local mods that are in the kernel partition will have to be added to the other kernel when a patch is determined for it. (Hopefully the /var partition would survive?)

In the event something were to go wrong that would prevent the update, it seems that simply restoring the original kernel partition which you back up before patching would get you in a state that it would be able to upgrade normally. Just looking for a little wisdom on the "risks" since my understanding is that this method is different from what has been done before.