Page 1 of 3 123 LastLast
Results 1 to 15 of 34

Thread: Tivoapp patch to remove Showcases

  1. #1
    Join Date
    Jan 2009
    Posts
    13

    Tivoapp patch to remove Showcases

    Hello All,

    I've been messing around a bit trying to come up with a patch to tivoapp to disable the displaying of the "yellow star" showcases, similar to the patches posted in this thread. The latest software version referred to in that post is 4.01b, which if I understand correctly was compiled using a different version of gcc than newer software revisions. That patch seems relatively straight forward, however the strings in tivoapp from 4.01b differ quite a bit than newer versions like 9.4/11.0 (which I am using), so I'm having a hard time finding a starting point.

    I've been fumbling around in the disassembly a bit using IDA (just happened across the script(s) in this thread, looks kinda promising), however mips{assembly} is definitely not my native tongue. Just wondering if anyone has any hints to find what I'm looking for, or if I've missed it, perhaps a link to the patch (I can't stand those f*cking ads!) I'm sure a tcl script to remove everything would work, but I'm sure tivo would probably get kind of annoyed that I download a few megs of ad slices everytime my box calls in for guide data.

    Any nudge in the right direction would be more than appreciated, I wish I had have found this forum years ago! Thanks.

  2. #2
    Join Date
    Nov 2004
    Posts
    420
    To my knowledge, the patch to disable "yellow stars" has not been carried forward and posted.

    Either IDA or the tmesis post processor will allow you to inspect the disassembly. However, the code in tivoapp has changed significantly since 4.0.1b, and the majority of the UI is now spread between tivoapp and brf resources.

    Your best bet might be to try to find similar strings to hone in on the pertinent section of the 9.4/11.0 tivoapp.
    Last edited by tivo4mevo; 01-11-2009 at 03:24 PM.

  3. #3
    Join Date
    Jan 2009
    Posts
    13
    Hi tivo4mevo, thank you for the helpful comments.

    I've managed to build mips-TiVo-linux-objdump and set up the tmesis script on cygwin. Looking through the disassembly output, I don't see the "Phase 2" string referenced. However, a few strings that are close to that reference in the tivoapp binary are present, such as "TvAtlasPromoItemData" and "TvAtlasPromoItemQueueData" appear to be in the same block of code, so I believe you are correct that that would be a good starting point.

    I have remote access to my machine from here at work, but it's not too pretty so I can't toy around much right now, but I'm definitely looking for clues/taking notes. Are these messages that tivoapp contains logged anywhere when the function is called, or could you possibly recommend any way to snoop around to try to find what is calling them? I suppose I could plant some bogus code and observe the resulting crashes for clues, but that seems a bit messy.

    I'll keep digging, and will post if I find anything useful. Thanks again for the information.

  4. #4
    Join Date
    Nov 2004
    Posts
    420
    I edited my initial post, as I think that I was barking up the wrong tree with the promos. You are right to try to correlate observed log messages with the tivoapp strings.

    I did a bit more searching and found this set of strings
    Code:
    "Showcase Indexer start"
    "pHasValidClipIndexWriterM"
    "pHasProgramIndexWriterM"
    "pIdentToIdIndexWriterM"
    "pIdentToProgramIndexWriterM"
    "pTmsIdToIdentIndexWriterM"
    "Showcase Indexer finished"
    and I see the first and last of these reflected in the logs.

    These strings all appear in a single procedure (which starts at 0x00c609b0 and 0x00d42d50 in tivoapp 9.4 and 11.0 respectively) and tracing through that procedure, it appears to return zero upon success.

    Perhaps showcases aren't available and aren't displayed until they're properly indexed. If so, an interesting test might be to patch the procedure to entirely skip the procedure.

    *edit* I think I'm wrong about the showcases as well. Looks like it the tivo central yellow stars might come from /MenuItem in MFS, which has it's own indexing code in tivoapp (0x0054ffd8/0x00652710 in 9.4/11.0), but perhaps the same logic applies? The best way to know for sure is to explore around, try out a patch, observe the result, and devise another patch if need be.
    Last edited by tivo4mevo; 01-11-2009 at 08:18 PM. Reason: correction as yellow stars more likely come from /MenuItem not from /Showcases

  5. #5
    Join Date
    Jan 2009
    Posts
    13
    tivo4mevo, thanks again for the hints.

    In my previous experience, altering values in both /Showcase or /MenuItem via tivosh caused the ads to disappear. I had to be rather careful with objects in /MenuItem however, since (somewhat) important things like Rhapsody, Netflix, Swivel Search would be affected if I wasn't careful. If /MenuItem is the target, the patch would need to be quite selective to avoid side effects that removed these features also.

    I'll try to toy around with this sometime tonight when I get a chance, if I find anything I'll be sure to post back. I managed to build a functional serial adapter for my box, so hey, I can't screw it up that bad ! Thanks again.

  6. #6
    Join Date
    Jan 2009
    Posts
    13
    Finally plugged away at this for a few hours last night without any success. I initially toyed with the functions mentioned by tivo4mevo. I tried bypassing the MenuItem and Showcase procedures either by nop'ing the jump that called the procedure or by just returning an immediate value instead of calling the function. Either way met without any change to the UI.

    I dumped the tvlog after only bringing up Tivo Central. Then I nuked all the ads from MFS in several locations with a tcl script I found around here somewhere(?). I then dumped the tvlog after bringing up Tivo Central without the ads. The only differences were references to TvXmpp procedures (TvXmppNetworkWatcherActivity, TvXmppPluginActivity, TvXmppMind). I bypassed these functions also using the same methods, and though the tivo boots successfully, the items still show up. The logs do not show the same entries now though, so perhaps these functions just log certain activities(?).

    I just found some terribly interesting code which may help to snoop around, called routerplus. It looks quite promising though it doesn't appear to have been updated in some time. Has anyone had any success using routerplus on newer software versions, and if so, perhaps some example code other than the stuff bundled with routerplus?

    TIA.

  7. #7
    Join Date
    Jan 2009
    Posts
    13
    Installed routerplus and toyed with it a bit today (very interesting!). Here's what I did:

    Code:
    rpsniff -t "" > rpsniff.tcl
    (used remote to enter Tivo Central)
    tivosh rpsniff.tcl > rpsniff.txt
    Looking in rpsniff.txt I found some interesting stuff :

    Code:
    serial 9:
    <TvBusEnvelope xs:type="TvPvrMenuItemRequest"><vSpec><element><area value="22">TIVO_CENTRAL_6</area></element></vSpec></TvBusEnvelope>
    serial 10:
    <TvBusEnvelope xs:type="TvPvrMenuItemRequest"><vSpec><element><area value="1">TIVO_CENTRAL</area></element></vSpec></TvBusEnvelope>
    serial 11:
    <TvBusEnvelope xs:type="TvPvrMenuItemRequest"><vSpec><element><area value="3">TIVO_CENTRAL_2</area></element></vSpec></TvBusEnvelope>
    serial 12:
    <TvBusEnvelope xs:type="TvPvrMenuItemRequest"><vSpec><element><area value="6">TIVO_CENTRAL_3</area></element></vSpec></TvBusEnvelope>
    serial 13:
    <TvBusEnvelope xs:type="TvPvrMenuItemRequest"><vSpec><element><area value="10">TIVO_CENTRAL_5</area></element></vSpec></TvBusEnvelope>
    and
    Code:
    serial 40:
    <TvBusEnvelope xs:type="TvPvrMenuItemInfoResponse"><vInfo><element><item><area value="22">TIVO_CENTRAL_6</area><idMenuItem>488556824887295</idMenuItem><uniqueName>tivo_VOD_SA3_721636</uniqueName><name>Video on Demand</name><decoratedName/><menuType value="6">HME</menuType><data>19452283-D00B-C411-595D-447ABF62F37C</data><displayFormat value="1">SINGLE</displayFormat><armInfo><idMenuItem>488556824887295</idMenuItem><zFilterInfo/><nPresented>0</nPresented><nSelected>0</nSelected><screenDisplayFormat value="0"/><serverId>137130090</serverId></armInfo><hmeInfo><uuid>19452283-D00B-C411-595D-447ABF62F37C</uuid><url>https://204.176.49.65:7287/tivocast_v2.2_20081208b-20081208_134612/1228772775/1228782316-1260318316/clientip_71.207.220.48/</url><isTrusted>true</isTrusted></hmeInfo></item></element></vInfo></TvBusEnvelope>
    serial 43:
    <TvBusEnvelope xs:type="TvPvrMenuItemInfoResponse"><vInfo><element><item><area value="1">TIVO_CENTRAL</area><idMenuItem>488432270835711</idMenuItem><uniqueName>fox_Lie_to_Me_PMIa_722160</uniqueName><name>Preview of the New Series LIE TO ME</name><decoratedName>&lt;tvml&gt;Preview of the New Series LIE TO ME&lt;/tvml&gt;</decoratedName><idImage>11742</idImage><idContentImage>104454</idContentImage><menuType value="1">SHOWCASE</menuType><data>2/fox/0901foxlietome</data><displayFormat value="2">DOUBLE</displayFormat><armInfo><idMenuItem>488432270835711</idMenuItem><zFilterInfo/><nPresented>0</nPresented><nSelected>0</nSelected><screenDisplayFormat value="0"/><serverId>142622235</serverId></armInfo><showcaseInfo><idShowcase>488651314167807</idShowcase><fShowcaseItem>false</fShowcaseItem><fItemHasClips>false</fItemHasClips></showcaseInfo></item></element></vInfo></TvBusEnvelope>
    serial 44:
    <TvBusEnvelope xs:type="TvPvrMenuItemInfoResponse"><vInfo><element/></vInfo></TvBusEnvelope>
    serial 54:
    <TvBusEnvelope xs:type="TvPvrMenuItemInfoResponse"><vInfo><element><item><area value="6">TIVO_CENTRAL_3</area><idMenuItem>488475220508671</idMenuItem><uniqueName>tivo_20081218Netflix_PMI_721971</uniqueName><name>It's Netflix on TiVo!</name><decoratedName/><idImage>57803</idImage><menuType value="1">SHOWCASE</menuType><data>2/tivo/0812netflix</data><displayFormat value="1">SINGLE</displayFormat><armInfo><idMenuItem>488475220508671</idMenuItem><zFilterInfo/><nPresented>0</nPresented><nSelected>0</nSelected><screenDisplayFormat value="0"/><serverId>142831314</serverId></armInfo><showcaseInfo><idShowcase>488750098415615</idShowcase><fShowcaseItem>false</fShowcaseItem><fItemHasClips>false</fItemHasClips></showcaseInfo></item></element></vInfo></TvBusEnvelope>
    serial 55:
    <TvBusEnvelope xs:type="TvPvrMenuItemInfoResponse"><vInfo><element/></vInfo></TvBusEnvelope>
    Comparing that to rpsniff.tcl I see it was coming from protocol 0x10357. Running 'rpsniff -s 0x10357' and going to Tivo Central confirmed this. Neither the string TvPvrMenuItemRequest nor TvPvrMenuItemInfoResponse appear anywhere in the tivoapp binary. However, a 'strings /tvlib/idl/0x10357.tvbin' reveals
    Code:
    TvPvrPromotionQuery
    Start
    Processing
    Done
    Hopefully I'm getting somewhere. If not, at least I'm learning

  8. #8
    Join Date
    Jan 2009
    Posts
    13

    Success (kinda)

    Well, I haven't found a suitable patch to tivoapp, but I was able to find a way to remove the ads using routerplus. I mildly hacked up chanflip.c, and now the ads are gone.

    All I did was change
    Code:
    uint32_t prot_id = 0x29040;
    to
    Code:
    uint32_t prot_id = 0x10357;
    in the main function, and added
    Code:
    if(words[1] == 0x1034f)
    {
    bytes[0x1b] = 0;
    }
    to the process_msg function. This has the same effect as setting the DisplayArea of the MenuItem object to 0 via tivosh. This hack does have the side effect of removing Rhapsody, Netflix, etc, but it should be easier to find a selective approach to that issue than it would be if using a tivoapp patch. I'll post more if I find anything.

  9. #9
    Join Date
    Sep 2001
    Location
    West of Bermuda
    Posts
    1,017
    good work, alferd.packer! we need some new blood around here. my tivo hacking has been minimal lately because i don't have any modern sa hardware, only directv boxes.

    ronny

  10. #10
    Join Date
    Nov 2004
    Posts
    420
    Yes, nice work.

    Good job on exploring things through Routerplus, rather than just disassembly. Making your routerplus application more selective by inspecting the TvPvrMenuItemInfoResponse's might be as easy as filtering responses by "menuType value" and dropping the unwanted ones (anything with a value other than 6?).

    However, as you may have already found, dropping messages (or even delaying them too long) can cause a crash, so you might need to investigate the 0x10357 protocol to determine an acceptable null response (akin to "nothing in the database" for that menu item area).

    Perhaps you could appropriately set the expiry time in MFS for all /MenuItem's, verify that tivo central no longer displays those ads, and then sniff tvbus to see that the TvPvrMenuItemInfoResponse looks like.

  11. #11
    Join Date
    Jan 2009
    Posts
    13
    Thanks guys. Not exactly what I was originally after, but I'm glad I found routerplus. It looks like a real piece of art. And, again I welcome the learning experience.
    Quote Originally Posted by tivo4mevo View Post
    Good job on exploring things through Routerplus, rather than just disassembly. Making your routerplus application more selective by inspecting the TvPvrMenuItemInfoResponse's might be as easy as filtering responses by "menuType value" and dropping the unwanted ones (anything with a value other than 6?).
    The value that I'm modifying corresponds to the folder in /MenuItem that the actual object is stored in. I looked at it last night and apps like Netflix are stored in different locations than the ads, so a selective approach should be rather easy using this method. I don't recall the specifics, but if you look in mfs you should see what I mean.
    However, as you may have already found, dropping messages (or even delaying them too long) can cause a crash, so you might need to investigate the 0x10357 protocol to determine an acceptable null response (akin to "nothing in the database" for that menu item area).
    Crashes, you say? From routerplus? I haven't noticed any issues yet, but then again, my testing only included checking TivoCentral, initiating a recording, and testing MRV. Good thing routerplus's source code is available. Is this an issue with routerplus, or with the way apps interact with it?
    Perhaps you could appropriately set the expiry time in MFS for all /MenuItem's, verify that tivo central no longer displays those ads, and then sniff tvbus to see that the TvPvrMenuItemInfoResponse looks like.
    That was my next thought. Anyone know the formula to calculate the time in mfs?

  12. #12
    Join Date
    Nov 2004
    Posts
    420
    To quickly clarify, routerplus doesn't crash, but using routerplus to drop/modify messages can cause tivoapp to crash.

    I don't have /MenuItem MFS values handy, but most times are stored in MFS as unix time (seconds since 1970). So setting to a ridiculously low number should work. You can also peek at different tcl scripts (fake call, fakecall.tcl, comes to mind) to see how most dates in MFS work.

  13. #13
    Join Date
    Jan 2009
    Posts
    13
    Quote Originally Posted by tivo4mevo View Post
    To quickly clarify, routerplus doesn't crash, but using routerplus to drop/modify messages can cause tivoapp to crash.
    I see what you mean. Since installing routerplus, my boxes freeze up every now and then while changing channels. It happens whether or not any routerplus hacks are in use. Sucks. But, we hath source code, so surely it's fixable. Having used routerplus for a few days, I've come up with quite a few hacks using it, so I definitely would hate to lose the functionality.

    Here are a few nuggets for anyone else to play with :

    Code:
    if(words[1] == 0x1034f && bytes[0x1b] != 0x16 && bytes[0x1b] != 0x20 && bytes[0x1b] != 0x19)
            bytes[0x1b] = 0;
    that should keep Netflix & Rhapsody stuff from getting removed from TivoCentral. Also, the pop-up (press thumbs up) ads that show up during playback are still there. If you neuter a byte from protocol 0x29a12 (0x01 to 0x00), you can remove those too. I found this thread, which had a script for adjusting the timeout to livetv value. The 0x2905e protocol refers to this action, and bytes [22-26] control the timeout value. Default is 5 minutes (0x0045d964b8). I tried a few variations successfully (1 minute/1 hour). This will set the default timeout to 4 hours :
    Code:
    if(words[1] == 0x2905f)
    {
            bytes[22] = 0x0d;
            bytes[23] = 0x18;
            bytes[24] = 0xc2;
            bytes[25] = 0xe2;
            bytes[26] = 0x80;
    }
    All only tested on 11.0, TivoHD.
    Last edited by alferd.packer; 01-23-2009 at 09:22 AM.

  14. #14
    Join Date
    Aug 2004
    Posts
    4,075
    Quote Originally Posted by alferd.packer View Post
    I see what you mean. Since installing routerplus, my boxes freeze up every now and then while changing channels. It happens whether or not any routerplus hacks are in use. Sucks. But, we hath source code, so surelys it's fixable.
    ...
    I've been told that increasing MSG_MAX_PER_CLIENT to 512 improves routerplus stability on recent tivo software releases.

  15. #15
    Join Date
    Jan 2009
    Posts
    13
    Quote Originally Posted by Jamie View Post
    I've been told that increasing MSG_MAX_PER_CLIENT to 512 improves routerplus stability on recent tivo software releases.
    Indeed it does! Thanks for the info.

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •