Page 1 of 2 12 LastLast
Results 1 to 15 of 30

Thread: Killhdinitrd SA S2 24004A with 7.2

  1. #1
    Join Date
    Jan 2005
    Posts
    997

    Killhdinitrd SA S2 24004A with 7.2

    Since it seems a rite of passage to post one's experiences/results, here are mine. I had to glean information from various threads and I figured it might help some folks embarking on this to have most of it in one place. My specific unit is the 24004A with software rev. 7.2.1 but this will work for 240040 and any other tivos that begin with 240.

    I don't want to preach but some words of wisdom. Read, learn, understand what you are doing. Read the killhdinitrd release thread here and also the killhdinitrd support thread here.

    Map out your plan, make notes. Make sure you have a FAT/FAT32 partition on your PC. This pre-planning will make things a LOT easier. Some familiarity with linux/unix helps too. You will need a boot cd and a proper kernel that already has killhdinitrd applied to it or one you will apply yourself. The folks at PTVUpgrade have a boot disk with pre-modded kernels for $5 here Or if you already have the correct kernel you can use the free lba48 boot disk at the same URL. You will also need some tools - one great source is Alphawolf's All-In-One binaries for the series2 found here. You also might want some other utilities found at sourceforge here.

    The following assumes you already have the boot cd, tools and most importantly the kernel you will be using. You surely should have made a backup image and tested it before you start - see Hinsdale's howto here for pointers. Also, since we are installing telnet and ftpd, I assume you have a USB ethernet adapter. I have used the older Linksys 100M and also the Netgear FA120. For a list of compatible adapters see tivo.com. Some details may have been left out, you are hereby warned...

    I chose to use a 3.1.5 kernel that already had killhdinitrd applied to it; many are now using the newer "7.2.2-oth.K1" killhdinitrd kernel which supports DHCP without additional modules. See notes below on DHCP.

    Now on to the goods...

    -----Hack TiVo SA S2 "240"-----

    1. Attach your tivo hard drive to your pc as "secondary master" and boot from ptvlba48 cdrom; your tivo hard drive should show up as /dev/hdc in the boot messages (dmesg). The following is based on my tivo hard drive located in the secondary master position (/dev/hdc); if you have your tivo drive in another location, edit accordingly. You can generally mount the 4th, 7th and 9th partitions on a tivo drive; sometimes either the 4th or 7th doesn't exist (especially after an mfstools backup/restore).

    Check what your current "root" is:

    bootpage -p /dev/hdc

    *output will either be hda4 or hda7 - mine was /dev/hda4 and we'll use that throughout; if your root is /dev/hda7 you will need to adjust accordingly.

    Make a mount point and mount the drive

    mkdir /mnt4
    mount /dev/hdc4 /mnt4

    2. Now dd in the killhdinitrd kernel to the appropriate partition

    If result of Step 1 was "/dev/hda4" then dd if=/path/to/vmlinux.px of=/dev/hdc3
    If result of Step 1 was "/dev/hda7" then dd if=/path/to/vmlinux.px of=/dev/hdc6

    3. Write new bootpage params to kernel

    bootpage -P "root=/dev/hda4 dsscon=true console=2,115200 upgradesoftware=false" -C /dev/hdc

    --those are capital P & C; it should be hda4 or hda7 depending on bootpage -p output; the 'root=/dev/hda[4or7]' should always be hda as it is the Primary Master IN THE TIVO! It should never be any letter other than a. The /dev/hdc after the -C is the letter of tivo hard drive when it is installed in your PC.

    4. Edit IPTABLES

    Two ways to do this:
    a.
    cd to /sbin on mounted "root" partition; i.e., cd /mnt4/sbin

    mv iptables iptables.old
    echo -e '#!/bin/bash\nexit 0' > iptables
    chmod 755 iptables

    *That's a zero above - \n (newline) exit 0 - your file should look like this when done:

    #!/bin/bash
    exit 0

    *Doublecheck it, this is the source of many errors...

    b. Easier way to "fix" iptables...
    insert the command:
    iptables -F
    Early in your rc.sysinit.author - see below...

    5. Create rc.sysinit.author

    cd to /etc/rc.d on mounted "root"; i.e., cd /mnt4/etc/rc.d
    touch rc.sysinit.author
    chmod 755 rc.sysinit.author
    vi rc.sysinit.author
    #!/bin/bash
    export PATH=$PATH:/hacks
    iptables -F
    tnlited 23 /bin/bash -login &
    setsid /bin/bash --login -i</dev/ttyS2&>/dev/ttyS2&
    tivoftpd&

    6. Move in some hacks

    --I like to have my utils right in bin--
    cp /path/to/ls /mnt4/bin
    cp /path/to/vi /mnt4/bin
    cp /path/to/setsid /mnt4/bin
    chmod 755 (all of the above) --do this for each

    --Make a directory for your hacks on the root partition--
    *Most people recommend you put your hacks in the root because the /var directory can be overwritten by tivo

    mkdir /mnt4/hacks --this name should match what you typed in rc.sysinit.author
    cp tivoftpd /mnt4/hacks
    chmod 755 /mnt4/hacks/tivoftpd

    7. Notes on USB network drivers and 8.x Software

    With the release of 8.x software, there is an apparent incompatibility between the stock tivo network drivers and the killhdinitrd kernels - reference 8.1 and my NIC thread. The incompatibility can be resolved by using Jamie's Backport Drivers. You'll need to copy the "host" drivers as well as the specific driver for your USB NIC. Read Jamie's README and look at your /etc/hotplug/usb.map for more info.

    *Finish

    cd /
    umount -f -a -r
    halt

    You should now have tivo booted with serial bash, telnet and tivoftpd running. Whatever else you want to do you should be in good shape.

    **Notes on DHCP
    The DHCP client (dhclient) does not work correctly with a killhdinitrd 3.1.5 kernel on 7.X software; read why here.
    Two solutions, use a static IP address entered in the Tivo GUI - navigate through "Network Settings" and enter a static ip address that matches your subnet. Or, if you would like to regain DHCP functionality with the 3.1.5 kernel, read how here.
    You can can also use the "7.2.2-oth.K1" killhdinitrd kernel with built-in DHCP support.

    ***Notes on Serial Bash/Channel Changing***

    If you plan on using the tivo serial port + cable to change channels, as with the Motorola cable box, you will need to disable the 'setsid /bin/bash --login -i</dev/ttyS2&>/dev/ttyS2&' line by placing a comment symbol (#) in front of this line or deleting it all together. Directing /bin/bash to the serial port will screw up your channel changing and cause the tivo to reboot when you try to change channels.

    ***Last but not Least - Serial Output***

    I spent more time working on getting serial cable output than anything else. Here's what finally worked for me - I used the serial cable from 9th tee, with a radioshack null modem adapter plus a radioshack female-to-female gender changer. You could also make your own serial cable with instructions here. I had a lot of problems getting output and it only worked when I used the "setsid" utility in Alphawolf's binaries (link above) and included the line above in rc.sysinit.author. For general help with serial console output see here; The specific thread I used in reaching my solution with setsid is here. The bonus is you end up with serial bash in case someday you need to get in for repairs and you don't have telnet...

    Best of luck, hope it helps and feel free to question, comment, etc.

    Peace, out.
    Last edited by ScanMan; 04-25-2007 at 10:55 AM. Reason: Add comments on USB network drivers and 8.x s/w

  2. #2
    Join Date
    Feb 2005
    Posts
    359
    Quote Originally Posted by ScanMan
    tnlited 23 /bin/bash -login &
    setsid /bin/bash --login -i</dev/ttyS2&>/dev/ttyS2&

    The bonus is you end up with serial bash in case someday you need to get in for repairs and you don't have telnet...
    Congrats on the successful hacking, and nice of you to type up some notes for those following in your foot steps. I do have a comment. With that setup the likelihood of being able to get in via the serial port for repairs in the event you can't get in via telnet is very very low. If the Tivo can't boot far enough to start the telnet daemon then the bash on the serial port isn't going to be started either.

  3. #3
    Join Date
    Jan 2005
    Posts
    997
    Good point; if rc.sysinit & rc.sysinit.author cannot complete you'll never get to serial bash since the boot aborts. It's still useful if you successfuly boot but your usb/ethernet drivers don't load correctly though right?

  4. #4
    Join Date
    Aug 2004
    Posts
    4,085
    Serial console access is especially valuable when you've messed things up so badly that your box won't boot at all: it gives you access to the PROM menu where you can boot with the alternate root. Just be sure you've set the prom password with crypto and have a working alternate root setup.

  5. #5
    Join Date
    Jan 2002
    Posts
    5,601
    Well done, and a request. You've done a pretty good job documenting what you did, but more information would be useful. I'd suggest you add links similar to what Cheer did in his roadmap.

    Also, it appears this should also work with the TCD140xxx TiVos if the appropriate 7.2.2-oth-K1 kernel and killhdinitrd 0.9.3. This also will allow use of dhcp.

    PlainBill
    There's a difference between needing help, and just being plain ole' lazy.

    "You cannot teach a man anything. You can only help him find it for himself." Galileo Galilei (1564-1642)

    HR20-700 with 2 TB, HR22-100, HR22-100, HR22-100, HR23-100 all running 0x5cd and networked.

  6. #6
    Join Date
    Mar 2006
    Location
    Los Angeles, CA
    Posts
    141
    export PATH=$PATH:/var/hacks
    tnlited 23 /bin/bash -login &
    setsid /bin/bash --login -i</dev/ttyS2&>/dev/ttyS2&
    /var/hacks/tivoftpd&
    scanman,

    Since you already included /var/hacks in your path: 'export PATH=$PATH:/var/hacks', can't you just invoke tivoftpd /wout using the full path '/var/hacks/tivoftpd'. Isn't that the whole point of the including the path?
    S3 / TCD648250b - Socketed
    Audio out of sync

  7. #7
    Join Date
    Jan 2005
    Posts
    997
    Yes, I guess I was being overcautious...

  8. #8
    Join Date
    Jul 2004
    Posts
    17
    Thanks for posting this. I was able to get my tcd240080 w/ 7.2 hacked. I had problems the first time because I was adding spaces where they were not needed in the rc.sysinit.author, but I copied the text over to word and I was able to read it correctly. The only problem I could find with the instructions is that it would say something like "cd /mnt4/sbin" where you would really need to type "cd /mnt/mnt4/sbin".

  9. #9
    Join Date
    Jan 2005
    Posts
    997
    The mount points depend on where you create/mount them. In my notes I created mount points right off the root.

    mkdir /mnt4
    mount /dev/hdc4 /mnt4

    The root (/) filesystem on the 4th partition would now be mounted at /mnt4. So everything is relative to that. You could create them at /mnt/mnt4 as I have seen other guides do. Whatever works...glad the notes helped!
    Last edited by ScanMan; 05-04-2006 at 08:53 AM.
    ScanMan --> Just another Tivo hacker...
    Killhdinitrd SA S2 Monte S2 Unscramble Upgrade Tivo Software

  10. #10
    Join Date
    Jan 2006
    Posts
    25
    what happen,i can not get out!!!
    vi rc.sysinit.author
    ~
    ~
    ~
    ~
    rc.sysinit.author [modified] line 7 of 7 ....100%
    hihi ,i donot know what i am doing

  11. #11
    Join Date
    Jan 2005
    Posts
    997
    Quote Originally Posted by caliman002 View Post
    what happen,i can not get out!!!
    vi rc.sysinit.author
    ~
    ~
    ~
    ~
    rc.sysinit.author [modified] line 7 of 7 ....100%
    hihi ,i donot know what i am doing
    You're using the 'vi' editor; you can use another editor you're more comfortable with if you like (like joe, etc.) If you're not comfortable with any unix editor, you can use google to learn some 'vi' commands or create the 'rc.sysinit.author' file in a windows text editor - just make sure you can save the file as "unix" - I wouldn't recommend notepad or wordpad, they will leave you with DOS-style line endings and your script will fail. Metapad is a freeware text editor that is unix-aware and easy to use.

    p.s. ":wq" (that's colon, w, q) will write and quit the file. Or ":q!" will quit discarding changes.

    Also, Captain Video's "Tivo Hacking 101" is a great place to start!!!
    Last edited by ScanMan; 12-14-2006 at 01:45 PM.
    ScanMan --> Just another Tivo hacker...
    Killhdinitrd SA S2 Monte S2 Unscramble Upgrade Tivo Software

  12. #12
    Join Date
    Nov 2006
    Posts
    6

    Tcd540...

    Just want to confirm this cannot be done on a TCD540040?

  13. #13
    Join Date
    Jan 2005
    Posts
    997
    Correct; killhdinitrd does not work on 540 tivos. They require a PROM modification to bypass the chain of trust. Check out the PROM socketing thread. Once the PROM is replaced with hacked code to bypass the chain of trust, you can install a kernel that has the initrd replaced with a null one and then proceed to obtain bash, start telnet, ftpd and hack to your heart's content.
    ScanMan --> Just another Tivo hacker...
    Killhdinitrd SA S2 Monte S2 Unscramble Upgrade Tivo Software

  14. #14
    Join Date
    Jun 2005
    Posts
    11
    Will this process be the same with 8.1 software on my TCD240?

  15. #15
    Join Date
    Jan 2005
    Posts
    997
    Yes, the process is the same. The only consideration is using the '7.2.2-oth.K1' kernel instead of the 3.1.5. The significant difference is the '7.2.2-oth.K1' supports DHCP out of the box without the need for additional modules. Oh and the other thing is to use the backport drivers instead of the stock USB network drivers which after 8.x are incompatible with the killhdinitrd kernels mentioned. See the "8.1 and my NIC" thead for more info.
    Last edited by ScanMan; 04-24-2007 at 10:47 AM.
    ScanMan --> Just another Tivo hacker...
    Killhdinitrd SA S2 Monte S2 Unscramble Upgrade Tivo Software

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •