s2_unscramble - Unscramble for Series 2

[ScrambleThis]

Below is the first portion of the readme; attached are the packages.

Regards,

ScrambleThis

--------------------------------

Introduction
------------

By popular request, from the ScrambleThis Labs, we present unscramble for
Series 2 TiVo boxes. In the context of this release, "Series 2" is anything
that runs a 2.4x Linux kernel on MIPS hardware. The initial release of
s2_unscramble will be for the 3.1x series (most non-DVD, non-HD boxes) and
3.1.5x (HD boxes, where the development of this software was done). Note
well that, though a 3.1.1x kernel with LBA48 support is provided, it has
NOT been tested! Only the 3.1.5x kernel has been tested.

First, some background: Some of you may be familiar with the original
unscramble for Series 1, implemented as the unscramble.o kernel module. The
bad news is: s2_unscramble effectively cannot be implemented in this manner.
If you're not willing to use a non-standard kernel (that is, one that was
built by someone other than TiVo) or non-standard extraction tools, you
probably should stop reading now.


Overview
--------

As some of you know, the low level calls used to access the MFS partitions
changed from the Series 1 kernels to the Series 2. Thanks to alldeadhomiez's
documentation of this mechanism, along with a sample util.c that can be used
in any Tridge-derived MFS toolset (read: all of them), we're able to create
a client-server system to cache and "play back" the scramble keys. The
extraction tools are the client, and the kernel becomes the server; as the
TiVo software plays a show, the kernel mods will cache the scramble keys for
later access by the extraction tools.

Upon extraction, the tools use a specially created "sentinel key" to initiate
interaction with the kernel, and instruct it to "play back" the keys. At this
point, the data is read in the clear, and can be used in any application that
processes unscrambled shows.

Obviously, this mechanism requires that the user be able to install a custom
kernel and extraction tools in his/her TiVo; the mechanics of doing this is
outside the scope of this document. In addition, the user should disable
future scrambling on the machine with the "nocso" or other hack.


Unscrambling methodology
------------------------

The s2_unscramble package includes two distinct methods of unscrambling. The
original motivation for this development began when a HD TiVo with a bad HDMI
port was brought into the ScrambleThis Labs with a request to somehow transfer
the programming to the replacement machine. The machine had not been
previously hacked in any way, thus the programming was scrambled.

The first efforts focused on the more traditional method of transferring
programming to another TiVo: mfs_ftp. Once the unscramble code was
implemented, extraction could proceed and went without issue. This method
would dictate that the custom kernel and extraction tools be in place
whenever a scrambled show is to be extracted.

However, some issues arose during insertion attempts that gave rise to a
second approach: Unscrambling the shows "in place" on the TiVo. This involves
reading a block of data with the unscramble functionality in place, then
writing the block back to the disk in the same place. Once this is done for
all of the shows on the disk, the custom kernel and extraction tools can be
removed. At that point, the disk is portable to another TiVo (same model, of
course) after running the 51kill.tcl script.

The "in place" unscrambling method is ideal for situations where a disk needs
to be transplanted into another TiVo. It's also good for situations where a
user may have a lot of scrambled programming that doesn't need to be extracted
in the near term, but the user doesn't want to run the custom kernel and tools
on an ongoing basis.

However, you are STRONGLY advised to make a FULL backup of your drive before
attempting the "in place" unscramble. Since you will be WRITING to the disk,
if anything goes wrong, some (even ALL) of your programming could be
rendered unusable. This cannot be stressed enough: "In place" unscrambling can
DESTROY your shows!

Once you've determined which method is right for you, read further to
determine what's needed.

[JohnSorTivo]

Awesome news! Thanks for your work on this.

Quick question, have the included custom kernels already been killhdinitrd'ed?

[StanSimmons]

Custom kernel requires monte.

[JohnSorTivo]

Custom kernel requires monte.

Gotcha. Load a killhdinitrd kernel, then monte into the custom kernel(s) provided. Sorry for the confusion, I clearly had a brain fart.

It's good to know that we can finally provide an answer, other than "sorry it can't currently be done" when series 2 users ask the question, "how do I unscramble previously scrambled recordings".

[Jamie]

For what it's worth, I built a 2.4.18 TiVo 4.0 kernel with the ide-disk patch from this package and have successful extracted and unscrabled a scrambled show on a 4.0.1b S2 SA using the mfs_ftp method.

Thanks for the package!

[TivoWare]

This sounds great!

But, Since I have a S2 with probably 75 shows on it, is there a way to make a script that will play part of each show so all the keys can be found?

[ronnythunder]

i remember doing this back in the s1 days. trust me, if you get that remote and get into a rythym, you can prime those shows pretty quick.

ronny

[massdave]

If I don't need to view old, previously recorded shows, do I need to do this?
I'm planning to run a killhdinitrd'd 4.01 kernel and after tivoapp adjustments want to know if I need to do this unscramble (and set up monte which I don't think I need up to this point).
Can I still extract the shows recorded after the tivoapp mod with having to unscramble?

Thanks in advance for your help... Dave

[JohnSorTivo]

If I don't need to view old, previously recorded shows, do I need to do this?

No. This is for extracting previously recorded shows that were recorded prior to disabling scrambling / encryption.

I'm planning to run a killhdinitrd'd 4.01 kernel

4.0.1a is your kernel then. Download it here:

http://www.dealdatabase.com/forum/sh...ad.php?t=38573

...and after tivoapp adjustments want to know if I need to do this unscramble

see first answer.

[and set up monte which I don't think I need up to this point).

You don't.

Can I still extract the shows recorded after the tivoapp mod with having to unscramble?

That's the point of the tivoapp patch

[ronnythunder]

johnsortivo is correct. playing scrambled shows on the tivo itself is no problem, even after the tivoapp patch for "nocso". the unscramble stuff is only if you want to extract scrambled shows.

so, has anyone besides jamie given it a run yet? none of my s2 units have any scrambled shows.

ronny

[JohnSorTivo]

so, has anyone besides jamie given it a run yet? none of my s2 units have any scrambled shows.

I'm in the same boat. Don't have a need for it, but good to know it's there should I in the future. Heck, at a minimum, it's another good source for an lba48 aware kernel, for those who aren't so inclined to compile their own

[Jamie]

For those interested in running this on 4.01b, here's a kernel compiled with gcc 3.0 from the TiVo-4.0-linux-2.4 sources. It's got the fpu patch, the lba48 patch, the s2-unscramble patch, and CONFIG_FILTER and CONFIG_NETFILTER are turned off. I use it with TiVo software version 4.0.1b on a S2 SA.

{Edit: I'm leaving this kernel up for historical purposes, but suggest you use the one in this post instead, since it is compatible with 4.0 on RID boxes. It also has CONFIG_FILTER turned back on, allowing DHCP to work. CONFIG_FILTER does not seem to affect network performance the way CONFIG_NETFILTER does.}

[steve457]

I was succesfully able to descramble/extract shows using the tserver method and tytools, but I'm having problems with the mfs_ftp method. I want to be able to use mfs_ftp to descramble and transfer a show to a 2nd tivo.

I'm using a DVR40, Sleeper'd (a long time ago), running 3.1.1c.

I'm able to connect using mfs_ftp, but when I click on the tmf directory to get a listing my connection gets closed. Here's the output from the port.3105.log file:

11:38:17:PM - 227 Entering Passive Mode (192,168,1,50,12,32).
11:38:17:PM - 150 Opening ASCII mode data connection for file list.
11:38:20:PM - updating cached recording info
..................................................................bgerror invok
d with error

" syntax error in expression "((0x - 4) / 256) + 1" "

re-initializing mfs_ftp

close the current ftp connection and simply open another

"core dump"

info(version): 1.2.9p
info(tswv): 3.1.1c-01-2-351
info(dbl): 0
info(ithrottle): 2
info(insert_priority): 10
info(multithreaded): 0
info(saveuntil): suggestion
info(name_detail): 5
info(bjuggle): 0
info(active): 0
info(ac_interval): 1800
info(gatewayip): 127.0.0.1
info(gatewayport): 3105

catch close lastsock val ""

I searched and found someone else who had a similar problem, but the solution was to use a different mfs_stream binary. In my case, I'm using the ones that were provided for the unscramble, so I'm not sure what the problem is. Any pointers, or suggestions?

thanks.

[chrised]

I was succesfully able to descramble/extract shows using the tserver method and tytools, but I'm having problems with the mfs_ftp method. I want to be able to use mfs_ftp to descramble and transfer a show to a 2nd tivo.

I'm using a DVR40, Sleeper'd (a long time ago), running 3.1.1c.

I'm able to connect using mfs_ftp, but when I click on the tmf directory to get a listing my connection gets closed.

I've had the same problem a couple of times too.

From what I can tell, this happens when your tivo is recording something.

Both times I had this occur, I cancelled the recording, restarted mfs_ftp (might not have been needed), and then it worked (note: I did NOT reboot the tivo).

Edit: I've also had to run csoscout.tcl on the target tivo afterwards to fix the shows. Refer to http://www.dealdatabase.com/forum/showpost.php?p=187489

[steve457]

Ok, I tried using the mfs_ftp method again this morning... and it worked! Previously I had my tivo set to 2 unavailable channels (570, 580), but this time I had the channels set to actual channels I receive. That seemed to do the trick. My tivo wasn't recording anything either time, so it seems my problem was a little different. (although the suggestion about the recording issue was the reason I tried a different channel).