Killhdinitrd SA S2 24004A with 7.2

[ScanMan]

Since it seems a rite of passage to post one's experiences/results, here are mine. I had to glean information from various threads and I figured it might help some folks embarking on this to have most of it in one place. My specific unit is the 24004A with software rev. 7.2.1 but this will work for 240040 and any other tivos that begin with 240.

I don't want to preach but some words of wisdom. Read, learn, understand what you are doing. Read the killhdinitrd release thread here and also the killhdinitrd support thread here.

Map out your plan, make notes. Make sure you have a FAT/FAT32 partition on your PC. This pre-planning will make things a LOT easier. Some familiarity with linux/unix helps too. You will need a boot cd and a proper kernel that already has killhdinitrd applied to it or one you will apply yourself. The folks at PTVUpgrade have a boot disk with pre-modded kernels for $5 here Or if you already have the correct kernel you can use the free lba48 boot disk at the same URL. You will also need some tools - one great source is Alphawolf's All-In-One binaries for the series2 found here. You also might want some other utilities found at sourceforge here.

The following assumes you already have the boot cd, tools and most importantly the kernel you will be using. You surely should have made a backup image and tested it before you start - see Hinsdale's howto here for pointers. Also, since we are installing telnet and ftpd, I assume you have a USB ethernet adapter. I have used the older Linksys 100M and also the Netgear FA120. For a list of compatible adapters see tivo.com. Some details may have been left out, you are hereby warned...

I chose to use a 3.1.5 kernel that already had killhdinitrd applied to it; many are now using the newer "7.2.2-oth.K1" killhdinitrd kernel which supports DHCP without additional modules. See notes below on DHCP.

Now on to the goods...

-----Hack TiVo SA S2 "240"-----

1. Attach your tivo hard drive to your pc as "secondary master" and boot from ptvlba48 cdrom; your tivo hard drive should show up as /dev/hdc in the boot messages (dmesg). The following is based on my tivo hard drive located in the secondary master position (/dev/hdc); if you have your tivo drive in another location, edit accordingly. You can generally mount the 4th, 7th and 9th partitions on a tivo drive; sometimes either the 4th or 7th doesn't exist (especially after an mfstools backup/restore).

Check what your current "root" is:

bootpage -p /dev/hdc

*output will either be hda4 or hda7 - mine was /dev/hda4 and we'll use that throughout; if your root is /dev/hda7 you will need to adjust accordingly.

Make a mount point and mount the drive

mkdir /mnt4
mount /dev/hdc4 /mnt4

2. Now dd in the killhdinitrd kernel to the appropriate partition

If result of Step 1 was "/dev/hda4" then dd if=/path/to/vmlinux.px of=/dev/hdc3
If result of Step 1 was "/dev/hda7" then dd if=/path/to/vmlinux.px of=/dev/hdc6

3. Write new bootpage params to kernel

bootpage -P "root=/dev/hda4 dsscon=true console=2,115200 upgradesoftware=false" -C /dev/hdc

--those are capital P & C; it should be hda4 or hda7 depending on bootpage -p output; the 'root=/dev/hda[4or7]' should always be hda as it is the Primary Master IN THE TIVO! It should never be any letter other than a. The /dev/hdc after the -C is the letter of tivo hard drive when it is installed in your PC.

4. Edit IPTABLES

Two ways to do this:
a.
cd to /sbin on mounted "root" partition; i.e., cd /mnt4/sbin

mv iptables iptables.old
echo -e '#!/bin/bash\nexit 0' > iptables
chmod 755 iptables

*That's a zero above - \n (newline) exit 0 - your file should look like this when done:

#!/bin/bash
exit 0

*Doublecheck it, this is the source of many errors...

b. Easier way to "fix" iptables...
insert the command:

iptables -F

Early in your rc.sysinit.author - see below...

5. Create rc.sysinit.author

cd to /etc/rc.d on mounted "root"; i.e., cd /mnt4/etc/rc.d
touch rc.sysinit.author
chmod 755 rc.sysinit.author
vi rc.sysinit.author
#!/bin/bash
export PATH=$PATH:/hacks
iptables -F
tnlited 23 /bin/bash -login &
setsid /bin/bash --login -i</dev/ttyS2&>/dev/ttyS2&
tivoftpd&

6. Move in some hacks

--I like to have my utils right in bin--
cp /path/to/ls /mnt4/bin
cp /path/to/vi /mnt4/bin
cp /path/to/setsid /mnt4/bin
chmod 755 (all of the above) --do this for each

--Make a directory for your hacks on the root partition--
*Most people recommend you put your hacks in the root because the /var directory can be overwritten by tivo

mkdir /mnt4/hacks --this name should match what you typed in rc.sysinit.author
cp tivoftpd /mnt4/hacks
chmod 755 /mnt4/hacks/tivoftpd

7. Notes on USB network drivers and 8.x Software

With the release of 8.x software, there is an apparent incompatibility between the stock tivo network drivers and the killhdinitrd kernels - reference 8.1 and my NIC thread. The incompatibility can be resolved by using Jamie's Backport Drivers. You'll need to copy the "host" drivers as well as the specific driver for your USB NIC. Read Jamie's README and look at your /etc/hotplug/usb.map for more info.

*Finish

cd /
umount -f -a -r
halt

You should now have tivo booted with serial bash, telnet and tivoftpd running. Whatever else you want to do you should be in good shape.

**Notes on DHCP
The DHCP client (dhclient) does not work correctly with a killhdinitrd 3.1.5 kernel on 7.X software; read why here.
Two solutions, use a static IP address entered in the Tivo GUI - navigate through "Network Settings" and enter a static ip address that matches your subnet. Or, if you would like to regain DHCP functionality with the 3.1.5 kernel, read how here.
You can can also use the "7.2.2-oth.K1" killhdinitrd kernel with built-in DHCP support.

***Notes on Serial Bash/Channel Changing***

If you plan on using the tivo serial port + cable to change channels, as with the Motorola cable box, you will need to disable the 'setsid /bin/bash --login -i</dev/ttyS2&>/dev/ttyS2&' line by placing a comment symbol (#) in front of this line or deleting it all together. Directing /bin/bash to the serial port will screw up your channel changing and cause the tivo to reboot when you try to change channels.

***Last but not Least - Serial Output***

I spent more time working on getting serial cable output than anything else. Here's what finally worked for me - I used the serial cable from 9th tee, with a radioshack null modem adapter plus a radioshack female-to-female gender changer. You could also make your own serial cable with instructions here. I had a lot of problems getting output and it only worked when I used the "setsid" utility in Alphawolf's binaries (link above) and included the line above in rc.sysinit.author. For general help with serial console output see here; The specific thread I used in reaching my solution with setsid is here. The bonus is you end up with serial bash in case someday you need to get in for repairs and you don't have telnet...

Best of luck, hope it helps and feel free to question, comment, etc.

Peace, out.

[ocntscha]

tnlited 23 /bin/bash -login &
setsid /bin/bash --login -i</dev/ttyS2&>/dev/ttyS2&

The bonus is you end up with serial bash in case someday you need to get in for repairs and you don't have telnet...

Congrats on the successful hacking, and nice of you to type up some notes for those following in your foot steps. I do have a comment. With that setup the likelihood of being able to get in via the serial port for repairs in the event you can't get in via telnet is very very low. If the Tivo can't boot far enough to start the telnet daemon then the bash on the serial port isn't going to be started either.

[ScanMan]

Good point; if rc.sysinit & rc.sysinit.author cannot complete you'll never get to serial bash since the boot aborts. It's still useful if you successfuly boot but your usb/ethernet drivers don't load correctly though right?

[Jamie]

Serial console access is especially valuable when you've messed things up so badly that your box won't boot at all: it gives you access to the PROM menu where you can boot with the alternate root. Just be sure you've set the prom password with crypto and have a working alternate root setup.

[PlainBill]

Well done, and a request. You've done a pretty good job documenting what you did, but more information would be useful. I'd suggest you add links similar to what Cheer did in his roadmap.

Also, it appears this should also work with the TCD140xxx TiVos if the appropriate 7.2.2-oth-K1 kernel and killhdinitrd 0.9.3. This also will allow use of dhcp.

PlainBill

[Offspring2099]

export PATH=$PATH:/var/hacks
tnlited 23 /bin/bash -login &
setsid /bin/bash --login -i</dev/ttyS2&>/dev/ttyS2&
/var/hacks/tivoftpd&

scanman,

Since you already included /var/hacks in your path: 'export PATH=$PATH:/var/hacks', can't you just invoke tivoftpd /wout using the full path '/var/hacks/tivoftpd'. Isn't that the whole point of the including the path?

[ScanMan]

Yes, I guess I was being overcautious...

[joverby540]

Thanks for posting this. I was able to get my tcd240080 w/ 7.2 hacked. I had problems the first time because I was adding spaces where they were not needed in the rc.sysinit.author, but I copied the text over to word and I was able to read it correctly. The only problem I could find with the instructions is that it would say something like "cd /mnt4/sbin" where you would really need to type "cd /mnt/mnt4/sbin".

[ScanMan]

The mount points depend on where you create/mount them. In my notes I created mount points right off the root.

mkdir /mnt4
mount /dev/hdc4 /mnt4

The root (/) filesystem on the 4th partition would now be mounted at /mnt4. So everything is relative to that. You could create them at /mnt/mnt4 as I have seen other guides do. Whatever works...glad the notes helped!

[caliman002]

what happen,i can not get out!!!
vi rc.sysinit.author
~
~
~
~
rc.sysinit.author [modified] line 7 of 7 ....100%
hihi ,i donot know what i am doing

[ScanMan]

what happen,i can not get out!!!
vi rc.sysinit.author
~
~
~
~
rc.sysinit.author [modified] line 7 of 7 ....100%
hihi ,i donot know what i am doing

You're using the 'vi' editor; you can use another editor you're more comfortable with if you like (like joe, etc.) If you're not comfortable with any unix editor, you can use google to learn some 'vi' commands or create the 'rc.sysinit.author' file in a windows text editor - just make sure you can save the file as "unix" - I wouldn't recommend notepad or wordpad, they will leave you with DOS-style line endings and your script will fail. Metapad is a freeware text editor that is unix-aware and easy to use.

p.s. ":wq" (that's colon, w, q) will write and quit the file. Or ":q!" will quit discarding changes.

Also, Captain Video's "Tivo Hacking 101" is a great place to start!!!

[TerminalE]

Just want to confirm this cannot be done on a TCD540040?

[ScanMan]

Correct; killhdinitrd does not work on 540 tivos. They require a PROM modification to bypass the chain of trust. Check out the PROM socketing thread. Once the PROM is replaced with hacked code to bypass the chain of trust, you can install a kernel that has the initrd replaced with a null one and then proceed to obtain bash, start telnet, ftpd and hack to your heart's content.

[Snafoo]

Will this process be the same with 8.1 software on my TCD240?

[ScanMan]

Yes, the process is the same. The only consideration is using the '7.2.2-oth.K1' kernel instead of the 3.1.5. The significant difference is the '7.2.2-oth.K1' supports DHCP out of the box without the need for additional modules. Oh and the other thing is to use the backport drivers instead of the stock USB network drivers which after 8.x are incompatible with the killhdinitrd kernels mentioned. See the "8.1 and my NIC" thead for more info.