Page 1 of 3 123 LastLast
Results 1 to 15 of 31

Thread: Help: Current hacking method for HR10-250?

  1. #1
    Join Date
    Jul 2003
    Posts
    202

    Help: Current hacking method for HR10-250?

    I just got my HR10-250, and am about 4 to 5 years removed from my last hacking attempt which was xTreme 2.5 on a SAT-T60. I just spent the past 2.5 hrs wading through the forums... and I'm lost... half the stuff is cryptic and the other stuff is outdated.

    Basically here is the end result I am looking to start with: 6.3b with fakecall & serial access. Yup, thats it for now. I don't want anything else... that includes PTV or son of sleeper splash screens, etc. My box is currently a brand new virgin 6.3a. I've been forcing calls for the past 4 days and can't seem to get 6.3b. I'm NOT looking to be spoonfed... I know how ya'll hate that..

    Basically where do I begin?

    I assume I need to killhdinitrd the drive before I can do anything.

    I have killhdinitrd 0.9.3 (which for some reason seems to say 0.9.2 beta when you run it...

    I have a vmlinux.px file thats 2,024,448 bytes...

    I ran "killhdinitrd vmlinux.px" on my XP box.. and got this:

    orig blocks = 00000f71
    orig image size = 001ee3e0 (excludes header)
    extended image size = 001eebe0
    kernel+initrd length = 001ee147 (excludes sig)
    kernel+initrd crc32 = 035c47e1
    identified kernel: 2.4.20 from TiVo OS 3.1.5 (HD TiVo)
    new blocks = 00000f71
    new image size = 001ee3e0 (excludes header)
    Finished!

    I assume this is all correct so far?

    Where do I go from here? I don't have any FAT32 drives on my PC (I run NTFS)... I guess I need to burn that 2MB file onto a CD?

    Is this the right LBA48 thing I need to download?

    http://www.dvrupgrade.com/dvr/stores...el&ModelID=101

    ???
    Last edited by SledgeHammer; 12-19-2006 at 02:08 AM.

  2. #2
    Join Date
    Dec 2005
    Posts
    296
    If you already ran killhdinitrd on a kernel (I'm assuming you're using the killhdinitrd Windows binary), you don't need to pay for that $5 CD. (0.9.3 does present itself as 0.9.2... but it's really 0.9.3. they forgot to update the version number text in the source.)

    Instead of using a 3.1.5 kernel with 6.3, run killhdinitrd on this virgin 7.2.2 kernel: vmlinux-series2-7.2.2-oth.k1-01-2.px.

    vmlinux-series2-7.2.2-oth.k1-01-2.px's MD5 before running killhdinitrd on it: fd71b861a767de9ad4a13dc5f78b6ae1

    vmlinux-series2-7.2.2-oth.k1-01-2.px's MD5 after running killhdinitrd on it: 0a219d8fc6eede2cd9a37f4481113661

    DON'T CONTINUE UNTIL YOUR 7.2.2 KERNEL MATCHES THAT MD5! (Check MD5s with this program. Just drag the .px file ontop of MD5Sums.exe in Windows Explorer.)



    Use this free Tivo Linux Bootcd: MFSLive

    While you are in Windows, download tivotools.tar.7z.

    Put tivotools.tar (not tivotools.tar.7z, extract the .tar out of the .7z) and your already-killhdinitrd'd kernel on a CD or USB stick.

    Tivotools (a.k.a. All-In-One Series 2 binaries a.k.a. busybox) includes the latest fakecall, standard linux commands (like ls,rm..), tivoftpd, and MUCH more.

    I'll skip netconfig.tcl and the backport drivers. With the backport drivers, you could have used this $12 USB Ethernet adapter: http://www.outpost.com/product/4415686 ... but you said you only wanted serial.

    ....

    First find out what your boot partition is, so type this in one of those Tivo Linux BootCDs (again, use the MFSLive CD):
    Code:
    bootpage -b /dev/hdX
    It will reply with either 3 or 6. Remember this number. It's VERY IMPORTANT.




    (I'm assuming you already how to mount a CD/USB stick in linux ... mount /dev/hdX /cdrom ... for a usb stick just mount it to /cdrom also,
    mount /dev/sda1 /cdrom mount /dev/sdb1 /cdrom )


    Then dd the kernel you ran killhdinitrd on in Windows to the partition that bootpage told you. i.e.:

    Code:
    dd if=/cdrom/vmlinux-series2-7.2.2-oth.k1-01-2.px of=/dev/hdX3
    
    OR
    
    dd if=/cdrom/vmlinux-series2-7.2.2-oth.k1-01-2.px of=/dev/hdX6


    Next, you have to set your bootpage paramaters. You'll need to remember what your boot partition is for this.

    If bootpage -b told you 3, your root partition is 4. If bootpage -b told you 6, your root partition is 7.

    NOTES: No matter what your drive's location is in your PC, the drive is hda when it's inside your Tivo. So ALWAYS use hda inside the quotes.... it's upgrade, not update... thats a capital P and C ...

    Code:
    bootpage -P "root=/dev/hda4 dsscon=true console=2,115200 upgradesoftware=false" -C /dev/hdX
    
    OR
    
    bootpage -P "root=/dev/hda7 dsscon=true console=2,115200 upgradesoftware=false" -C /dev/hdX

    Now that the killhdinitrd kernel is in the right partition and your bootpage is set, it's time to mount your Tivo's root filesystem.


    First make a mount point (Note: this is not necessary with the MFSLive CD, the /tivo folder has already been made on the MFSLive CD.)

    Code:
    mkdir /tivo
    Now you mount your Tivo's root to that /tivo mount point. You'll need to remember what your root partition is.

    Again, if bootpage -b earlier told you 3, your root is 4.
    If bootpage -b told you 6, your root is 7.


    Code:
    mount /dev/hdX4 /tivo
    
    OR
    
    mount /dev/hdX7 /tivo


    Now make /tivo-bin and extract tivotools.tar into there.

    Code:
    mkdir /tivo/tivo-bin/
    tar -xvf /cdrom/tivotools.tar -C /tivo/tivo-bin/
    Next, disable the Tivo firewall (in older Tivo software versions, you had to disable netfilter... with current versions, you must replace iptables.)

    First you backup your iptables by renaming it to "iptables.orig"

    Then you must make a new iptables with a little script that exits when run. You must BE EXACT WITH EVERY LETTER OF THE ECHO LINE!!!!
    Pay attention to slash order: /'s and \'s.... thats a single quote: ' ... thats a 0 (number), not an O (letter) ...

    Then you must make your new iptables executable with chmod.

    Code:
    mv /tivo/sbin/iptables /tivo/sbin/iptables.orig
    echo -e '#!/bin/bash\nexit 0' > /tivo/sbin/iptables
    chmod 755 /tivo/sbin/iptables

    Last thing you need to do is make your rc.sysinit.author:

    First change directory to /tivo/etc/rc.d/

    Code:
    cd /tivo/etc/rc.d/
    Then make a rc.sysinit.author (DON'T MAKE IT IN WINDOWS UNLESS YOU HOW TO SAVE IN UNIX MODE, you can just cp it from your cd/usb if you do.. make it in vi to be safe) file and open it in vi. Read up on vi commands here... Press ":", then "x" and then "Enter" to exit and save...

    Code:
    touch rc.sysinit.author
    vi rc.sysinit.author
    Code:
    #!/bin/bash
    export PATH=./:.:/bin:/sbin:/tvbin:/tivo-bin
    export TIVO_ROOT=
    export MFS_DEVICE=/dev/hda10
    
    #serial bash... BE EXACT WITH THIS OR SERIAL WONT WORK!
    /bin/bash</dev/ttyS2&>/dev/ttyS2&
    
    #telnet
    /sbin/tnlited 23 /bin/bash -login &
    
    #ftp
    /tivo-bin/tivoftpd
    
    #fakecall
    /tivo-bin/fakecall.tcl
    (I put telnet/ftp in there in case you decide to use networking later on..)

    After you are done making rc.sysinit.author, make it executable:
    Code:
    chmod 755 rc.sysinit.author

    Now, cd to /, umount (not unmount) your Tivo drive, poweroff.

    Code:
    cd /
    umount /tivo
    poweroff
    Last edited by drez; 12-19-2006 at 10:45 PM.

  3. #3
    Join Date
    Jul 2003
    Posts
    202
    Did you forget about me?

    I thought the 7.x software was for the standalone / 2.5 / 3 boxes only and not for the HR10?

  4. #4
    Join Date
    Nov 2004
    Location
    Gurnee, IL
    Posts
    2,385
    You're confusing kernel version with software version. The kernel that comes with 7.2.2-oth-K1 will work with any S2 Tivo software based on linux 2.4.20, standalone or DirecTivo.
    --
    Christopher D. Heer
    Quote Originally Posted by Oscar Wilde
    Perhaps, after all, America never has been discovered. I myself would say that it had merely been detected.

  5. #5
    Join Date
    Dec 2005
    Posts
    296
    I updated the post.

  6. #6
    Join Date
    Jul 2003
    Posts
    202
    Awesome drez!! Thanks! Beyond the call of duty for sure...

    I remember when I did xTreme with my T60, it was a little weird because I was using a SCSI CD-ROM (and still am) and the mount points were different... although I do have an IDE DVD-R now...

    So this is all for the 6.3a right? I assume if I ever get the 6.3b authorized, it'll overwrite everything... I've been waiting for that, so I thought there might be some kind of hack to get 6.3b "now".

    Is there a way to "authorize" 6.3b with the drive in my PC? or is that something that needs to be done with the drive in the tivo?

    I'll start working on this over xmas vacation... wanna get this puppy subbed and into service .

  7. #7
    Join Date
    Nov 2002
    Posts
    480
    Quote Originally Posted by SledgeHammer View Post
    Awesome drez!! Thanks! Beyond the call of duty for sure...


    Is there a way to "authorize" 6.3b with the drive in my PC? or is that something that needs to be done with the drive in the tivo?
    From what I've read, there is not much in 6.3b to merit the time to get it. I don't think you can go wrong sitting on 6.3a for now, IMHO.

  8. #8
    Join Date
    Jul 2003
    Posts
    202
    6.3a has random reboots and OTA audio dropouts.

  9. #9
    Join Date
    Jul 2003
    Posts
    202
    FYI: FOR THOSE FOLLOWING THIS GUIDE, THE BOOTPAGE UTIL POINTED TO IN THIS THREAD RETURNS EITHER 4 or 7, WHICH IS *** INCORRECT *** SUBTRACT -1 TO GET THE REAL BOOTPAGE OR YOU WILL DESTROY YOUR IMAGE.

  10. #10
    Join Date
    Feb 2006
    Location
    Salt Lake City, Utah
    Posts
    6
    Quote Originally Posted by SledgeHammer View Post
    FYI: FOR THOSE FOLLOWING THIS GUIDE, THE BOOTPAGE UTIL POINTED TO IN THIS THREAD RETURNS EITHER 4 or 7, WHICH IS *** INCORRECT *** SUBTRACT -1 TO GET THE REAL BOOTPAGE OR YOU WILL DESTROY YOUR IMAGE.
    I'm about to hack my 6.3a system. From your post then, should I use hda3 or hda6 in the following statements?

    bootpage -P "root=/dev/hda4 dsscon=true console=2,115200 upgradesoftware=false" -C /dev/hdX

    OR

    bootpage -P "root=/dev/hda7 dsscon=true console=2,115200 upgradesoftware=false" -C /dev/hdX

  11. #11
    Join Date
    Dec 2005
    Posts
    296
    DON'T GUESS!!!

    The bug SledgeHammer was referring to was a bug that when you ran bootpage -b, it would respond with 4 or 7, INSTEAD OF 3 OR 6.

    (-b for boot, to find out what the BOOT partition is.)

    Code:
    bootpage -b /dev/hdX
    In other words, bootpage -b would respond with one more number than it was suppose to.


    This bug has been FIXED in the latest release (6b) of MFSLive BootCD. Release Notes here. You can follow my instructions as is with this version.


    Helpful Information:

    Boot is ALWAYS one less than the ROOT partition.

    The ONLY possible combinations for a TiVo are 3(boot)/4(root) OR 6(boot)/7(root).

    The BOOT partition is where you DD the kernel to.
    The ROOT partition is the partition you mount to add/edit files (like rc.sysinit.author, tivotools, backport drivers, etc) on your Tivo.
    Last edited by drez; 01-01-2007 at 02:06 PM.

  12. #12
    Join Date
    Oct 2005
    Location
    Eastern U.S.
    Posts
    8
    [QUOTE=drez;272726]DON'T GUESS!!!

    The bug SledgeHammer was referring to was a bug that when you ran bootpage -b, it would respond with 4 or 7, INSTEAD OF 3 OR 6.

    (-b for boot, to find out what the BOOT partition is.)

    Code:
    bootpage -b /dev/hdX

    Quick Question:
    If I'm running Dtivo version 6.2, is this the proper code command for me to determine boot partition? I'm not sure if the reported partition is correct, or if I am supposed to pick the opposite... seems I've seen previous posts that give conflicting information. Not sure if this is 6.2 version dependent?

  13. #13
    Join Date
    Dec 2005
    Posts
    296
    Yes, you can use my instructions with 6.2 too... Just use the 6b release of MFSLive and you can follow my instructions as is.

    Like I said in the original post, you won't have the backport networking drivers (that would let you use this relatively cheap $12 Airlink adapter from Fry's/Outpost) as I didn't include that in my instructions.

    I'm not supposed to mention it here at DDB but.. if you would like to use those backport drivers, use The Zipper (don't reply with ANY Zipper questions.)

    After you have a hacked box, start looking around (keyword: *look*. don't touch until you know what you're doing) to see how the thing works. Like I did.
    Last edited by drez; 01-01-2007 at 02:40 PM.

  14. #14
    Join Date
    Jan 2002
    Posts
    5,601
    It would help if you told us how the drive is mounted. If it is in a hacked TiVo,
    bootpage -b /dev/hda is correct, and will report the correct number.

    If it is primary master in a pc and you are using an early (4.01) PTVupgrade cd,
    bootpage -b /dev/hda is correct, but will report one number high (4 instead of 3).

    If it is secondary slave in a pc, and you are using the latest MFSLive boot cd,
    bootpage -b /dev/hdd is correct, and it will report the correct partition.

    PlainBill
    There's a difference between needing help, and just being plain ole' lazy.

    "You cannot teach a man anything. You can only help him find it for himself." Galileo Galilei (1564-1642)

    HR20-700 with 2 TB, HR22-100, HR22-100, HR22-100, HR23-100 all running 0x5cd and networked.

  15. #15
    Join Date
    Oct 2005
    Location
    Eastern U.S.
    Posts
    8
    Thanks PlainBill for the quick response!
    (also thanks for being patient with us newbies that are trying to learn without messing up our wife's tivo shows.)

    My drive is currently mounted in a hacked Dtivo, and is running great to be able to record shows un-encrypted and move them to PC with tytools.

    This is my thought pattern:
    My assumption is that the tivoapp is not virgin on the hacked Dtivo.
    My other assumption is that the tivoapp on the original drive (in a drawer) is the one I need to get. Then maybe copy the tivoapp from the original drive to a floppy or thumbdrive using a standby desktop PC. Move the virgin tivoapp to my home PC which has network access to the working Dtivo. Then I could telnet to the working Dtivo and copy the virgin tivoapp to the proper directory (backing up the current version first). Then reboot with the virgin tivoapp in place, and apply the Superpatch-67all patch.

    I'm trying to determine if this is the correct approach, and if it will screw up the playback of my current un-encrypted recordings.

    Worst case, I suppose I could pull the hacked drive, clear it, and start all over again. But I was hoping to be able to apply the Superpatch without pulling the working drive from the Dtivo.

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •