Page 3 of 4 FirstFirst 1234 LastLast
Results 31 to 45 of 59

Thread: S3 hack for CCI after PROM mod

  1. #31
    Join Date
    Jan 2004
    Location
    n.h. usa
    Posts
    955
    i dont use a modern pc with sata ports.. i use an old 486 with 1 hard drive just to bakcup and restore images from... mfs live and a sata to ide converter works fine

  2. #32
    Join Date
    Apr 2009
    Posts
    13
    Quote Originally Posted by lrhorer View Post
    Did you get that directly from him? I haven't seen any public announcement of it. I know he is winding down his involvement with mods, but I have heard nothing to the effect he has already shut down. I've got one more S3 I want someone to modify at some point. If Omikron isn't available at the time, perhaps Cartouchbea will be my choice. There have been others from time to time.
    I inferred it from a couple of his threads, one where he talks about winding down, and another where he talks about selling off his modding equipment.

    Quote Originally Posted by lrhorer View Post
    What I personally recommend in general is to take your TiVo after it arrives and immediately upgrade the hard drive to at least a 500G - available online for under $60. WinMFS does a really good job, and is quite easy. MFS_Live is a bit more difficult to use, but also much more flexible. Either way, I would copy the stock drive to the 3rd party drive and expand the storage using one of those tools. Take the original drive, and store it in a safe place, hacking only the upgrade drive. That's both the safest and quickest solution, not to mention one with the best side-benefits.
    My biggest problem with modding it right away is, that the first unit I got had problems immediately (I'm scheduled to get the RMA back today). 8 times in the first 24 hours, the unit would powercycle (simply shutoff & come back up to the Powering Up screen). This is before I installed the CableCards (actually, the first time was within minutes of powering the device on). I haven't even called TWCable to re-order the CableCards (had to call em & cancel the first service call cuz I was RMAing the Tivo).

    I'd like to be able to know this is a good unit (possibly a week of use with the cablecards installed) before I consider breakin the seal (warranty).

    Does that seem reasonable?

  3. #33
    Join Date
    Jul 2005
    Posts
    504
    Quote Originally Posted by TheLandYacht View Post
    I'd like to be able to know this is a good unit (possibly a week of use with the cablecards installed) before I consider breakin the seal (warranty).

    Does that seem reasonable?
    Make an automatic record wishlist with the only option being "category : HD" and it will test it real well for you I did this to test my 2TB and I was surprised at how fast the drive will filled up.

    Check out these file sizes and you will understand why the stock drive is,,, well,,, crap plain and simple.



  4. #34
    Join Date
    Apr 2009
    Posts
    13
    Quote Originally Posted by ciper View Post
    Make an automatic record wishlist with the only option being "category : HD" and it will test it real well for you I did this to test my 2TB and I was surprised at how fast the drive will filled up.

    Check out these file sizes and you will understand why the stock drive is,,, well,,, crap plain and simple.
    On the auto-record wishlist, thanks for the heads up. I'll give that a shot.

    I knew about file sizes. And I do have plans to upgrade the drive, just wanna make sure the new unit isn't doa before I throw away the warranty by breaking the seal.

  5. #35
    Join Date
    Apr 2009
    Posts
    13
    Quote Originally Posted by TheLandYacht View Post
    On the auto-record wishlist, thanks for the heads up. I'll give that a shot.
    On the autorequest wishlist, I couldn't select HD as a category yet cuz the cablecards will be a couple of days comin.

    But I got it runnin recording "wishlist:Kids", which includes a large number of Disney shows, oddly enough!

    Anyway, testing. Will keep you guys posted. Thanks again for all the help!

  6. #36
    Join Date
    Jul 2005
    Posts
    504
    Hmm, you could connect an antenna. It has higher bitrates than the cable versions of each channel.

    Alternatively you could make a wishlist that has the rating TV-G with an OR statement to the rating TV-Y

  7. #37
    Join Date
    Jun 2009
    Posts
    4

    Removing Copy Control Info (CCI) checking

    Quote Originally Posted by ray08 View Post
    My end objective is to be able to transfer shows from Tivo to PC that are marked as copyright protected (CCI). I have comcast and they (comcast) have unilaterally decided ALL shows are copyright protected unless available OTA, more or less.
    Much of the discussion in this forum assumes you want to gain complete control of your TiVo and run your own software on it. Here I'll assume that all you want to do is transfer protected TV shows to your PC. This is easier.

    The Tivo software allows shows that aren't copy protected to be transferred from your Tivo to your PC using a web browser or programs such as Tivo Desktop (PC) or iTivo (Mac). If you turn off CCI checking, you can also transfer shows that are protected. This change can be done by modifying a few bytes in the Tivo software on the Tivo disk, which you can do with the disk attached to your computer. But it's not quite that easy: the Tivo will refuse to run with modified software unless you also stop it from checking whether the software it's running is official Tivo software!

    Eliminating the checking for "trusted software" on a Series 3 Tivo takes two steps: change the PROM so that it doesn't check the kernel when the machine starts up, and change the kernel so it doesn't check the rest of the software. There are people on this forum who will replace the PROM for you or sell you a modified PROM you can replace yourself (there's good advice on soldering and desoldering here).

    Software changes on disk can be done using the MFSLive CD, which contains a basic Linux environment that is able to access the Tivo disk. This can be run standalone, or inside a virtual machine on your PC or Mac. You can use a SATA to USB adapter (e.g. Sabrent C35U) to attach the Tivo disk to your computer without removing it from the Tivo box. Just open the box with a Torx 10 screwdriver, remove the SATA cable from the disk and attach the adapter. Then when you plug the USB cable into your computer, console messages appear in Linux: for me the disk shows up as "/dev/sda".

    Running "pdisk -l /dev/sda" lists the partition map for the disk. The software is on either partitions 2, 3 and 4, or else on 5, 6 and 7. Which are used changes each time the Tivo software updates: new software is loaded into the set that isn't currently being used. The command "bootpage -b /dev/sda" will tell you which partition has the active kernel (3 or 6). To "fix" the kernel you can use the compiled program "busybox.replace_initrd.x86" from the tar archive "replace_initrd.x86.tar.gz" found in the dealdatabase files section. You'll also need the file "null-linuxrc.img.gz": these two files aren't on the MFSLive CD but you can transfer them into the running Linux on a USB flash drive. If partition 3 is the active kernel, you need to execute the command

    busybox.replace_initrd.x86 /dev/sda3 null-linuxrc.img.gz original_kernel.bak

    where the last argument can be any name you want to give to a backup of the bytes of the kernel that are modified. This command scans the kernel partition to find the "initrd" initialization routine, which it replaces with a null routine (null-linuxrc) that does nothing.

    Now you can finally make the CCI change to the Tivo software! Again assuming 2/3/4 are the active software partitions,

    mount -t ext2 /dev/sda4 /tivo

    and "/tivo/tvbin/tivoapp" is the file you need to change. The changes you need to make depend on which version of the Tivo software you have: your software version number is available when your Tivo is running, displayed under the "System Information" submenu of "Messages & Settings". Look for a Series 3 Support forum thread about your version "sitting in the Tivo Media File System" (e.g., 11.0d sitting in MFS). The changes should be listed there.

    In two places in tivoapp, four bytes need to be changed from "30 b0 00 ff" to "00 00 80 21" and in one place "00 e0 88 21" needs to be changed to "24 11 00 00". As long as the relevant routines in the Tivo software don't change, these patches will move around from version to version but won't otherwise change. If you'd like to see exactly what changes these patches make in the code, a MIPS architecture version of the Linux "binutils", compiled to run on x86, is available on sourceforge. See also this discussion of Tivo disassembly tools.

    The patches can be made using the "dd" program. The places where the changes should be made are listed in hex, using the addresses where the code will execute: you need to subtract 0x400000 to get the offsets from the beginning of the tivoapp file where the code is stored. For example, for the 11.0d software version, the first CCI patch is at execution address 0x00656e40. This becomes an offset of 0x00256e40 within tivoapp, which is 2453056 in decimal. The original contents of the four bytes starting at that offset can be examined using

    dd if=/tivo/tvbin/tivoapp bs=1 count=4 skip=2453056 | hd

    and seen to be "30 b0 00 ff". These four bytes can be replaced with "00 00 80 21" using the command

    echo -ne "\x00\x00\x80\x21" | dd conv=notrunc of=/tivo/tvbin/tivoapp bs=1 seek=2453056

    and the other two patches can be done similarly. Remember to unmount /tivo before disconnecting the disk! These changes will only turn off copy protection for TV recordings, not for on-demand purchases. Eventually protected TV recordings will start showing up again, indicating that the Tivo software has been updated. The kernel and tivoapp patches will then need to be repeated.
    Last edited by no_cci; 10-30-2009 at 03:59 PM. Reason: clarified that the goal here is not to get shell access

  8. #38
    Join Date
    Mar 2006
    Location
    Los Angeles, CA
    Posts
    140
    I'm a little confused about CCI patch. My s3 tivo, tivoapp is patched with nocso and I've been able to grab all of my recordings (mostly sports) with mfs_ftp and converting ty to ts with s3tots. No problem. Do I need to kill the CCI byte? Have I been lucky and not ran across any recordings flagged with the CCI byte? I have time warner cable, btw.
    Last edited by Offspring2099; 10-03-2009 at 04:39 PM.
    S3 / TCD648250b - Socketed
    Audio out of sync

  9. #39
    Join Date
    Jan 2002
    Posts
    214
    You will likely only see the CCI Byte set if you have cablecards in your TiVo.

  10. #40
    Join Date
    Apr 2002
    Posts
    884
    Quote Originally Posted by Offspring2099 View Post
    I'm a little confused about CCI patch. My s3 tivo, tivoapp is patched with nocso and I've been able to grab all of my recordings (mostly sports) with mfs_ftp and converting ty to ts with s3tots. No problem. Do I need to kill the CCI byte? Have I been lucky and not ran across any recordings flagged with the CCI byte? I have time warner cable, btw.
    Quote Originally Posted by StanSimmons View Post
    You will likely only see the CCI Byte set if you have cablecards in your TiVo.
    I'm 99%+ sure mfs_ftp doesn't care what the CCI byte is set to.

    Posters who use the CCI patch want to maintain the ability to MRV between a hacked and an unhacked unit. Those posters can't use the noCSO patch, therefore can't use mfs_ftp and have to use TTG to transfer shows to their PC.
    Last edited by newbie; 10-05-2009 at 04:42 PM.

  11. #41
    Join Date
    Jun 2006
    Location
    Dougal County
    Posts
    1,007
    Quote Originally Posted by newbie View Post
    I'm 99%+ sure mfs_ftp doesn't care what the CCI byte is set to.
    100% sure

  12. #42
    Join Date
    Mar 2006
    Location
    Los Angeles, CA
    Posts
    140
    Quote Originally Posted by newbie View Post
    I'm 99%+ sure mfs_ftp doesn't care what the CCI byte is set to.

    Posters who use the CCI patch want to maintain the ability to MRV between a hacked and an unhacked unit. Those posters can't use the noCSO patch, therefore can't use mfs_ftp and have to use TTG to transfer shows to their PC.
    Thanks for clearing things up. I do have a more specific question. If a channel I tune to is coded "003" - "the content can be recorded and viewed for 90 minutes after transmission, and is not transferable. Content disappears from the Now Playing list after 90 minutes."
    Will this recording be hidden from mfs_ftp as well?
    S3 / TCD648250b - Socketed
    Audio out of sync

  13. #43
    Join Date
    Jun 2006
    Location
    Dougal County
    Posts
    1,007
    Will this recording be hidden from mfs_ftp as well?
    not if it actually deletes itself

    if you hack around the cci byte then those recordings should be fine

    there are a few ways to poke tivoapp to keep 0x03 recordings from self-deleting

  14. #44
    Join Date
    Sep 2009
    Posts
    15

    Dumb Question

    My Tivo is filling up rapidly with shows that have the CCI bit to not allow me to copy the files.

    Let me ask this:

    If I take the hard drive out of the unit and boot my Computer using WinMFS http://www.mfslive.org/ can i copy these programs onto another HD and then use the decryption tools from other programs on them??

    I know i could buy anohter Tivo, have it's PROm replaced and modify the software to allow FTP'ing into it - but can I do it they way I just describe it?

    Thanks.

  15. #45
    Join Date
    Aug 2010
    Posts
    4

    Error message "-bin/sh: busybox.replace_initrd.x86: not found"

    Hello -

    I am trying to use no_cci's method as described above. As you will see, I really don't know what I'm doing.

    The story so far:

    I can boot into mfslive with my tivo drive attached - the "pdsik -l /dev/sda" and "bootpage -b /dev/sda" commands work, showing the partition map and active kernel as 3.

    I have had no luck mounting my sata dvd drive nor my pata dvd drive. So, going old school, I have copied the "busybox.replace_initrd.x86" and "null-linuxrc.img.gz" files to a fat32 floppy.

    At the "[mfslive:/]#" prompt I believe that I have successfully mounted the floppy with the command "mount -t vfat /dev/fd0 /floppy".

    When I change dir to "/floppy" and type "ls" the two files "busybox.replace_initrd.x86" and "null-linuxrc.img.gz"are shown in green.

    At the "[mfslive:/]:" prompt I then type the command:
    "busybox.replace_initrd.x86 /dev/sda3 null-linuxrc.img.gz original_kernel.bak"

    When I hit enter I receive the message:

    "-bin/sh: busybox.replace_initrd.x86: not found"

    I am stuck here - any suggestions would be greatly appreciated.

    Thanks!

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •