11.0f sitting in MFS

[jt1134]

heh, probably should have posted a disclaimer

the nopromos patch above is ported from the one I posted here, and unfortunately will mess with the Netflix/VoD stuff

the deletethisrecording? patch above is ported from the one tivo4mevo posted here

fixed the bufferhack line above also, as it got truncated in the copy 'n paste haste

[lgkahn]

thanks for the heads up on the no promo patch.. will back that one out..
as for the bufferhack line dont think that is the issue as i did fix it and tried wih the entire string and it still hangs the box..

here are the relavent sections of my bufferhack11.tcl file that dont work

# Version addrA addrB addrC addrD filesize SHA1
# DirecTivo (length) (center) (brf) (filepart)
set sys(6.2) [list 0x66684a 0x666426 0x6d 0x8c8426 18123880 B78BB8DAD4925748AA5E8C974D2E66C635D2E5D8]
set sys(6.2a) [list 0x667b5a 0x667736 0x6d 0x8ca392 18149528 B78BB8DAD4925748AA5E8C974D2E66C635D2E5D8]
# Standalone
set sys(7.1) [list 0x1db122 0x1dad36 0x71 0x13ea5e 22051388 A9846DD76AEF86CEA6B3E69CE3758227598991A0]
set sys(7.1a) [list 0x1daf62 0x1dab76 0x71 0x13ea5e 22051388 A9846DD76AEF86CEA6B3E69CE3758227598991A0]
set sys(7.1b) [list 0x1daf6e 0x1dab82 0x71 0x13ea5e 22051388 A9846DD76AEF86CEA6B3E69CE3758227598991A0]
set sys(7.2.1-oth) [list 0x0d6e9e 0x0d6cb6 0x71 0x1a04da 21732904 A9846DD76AEF86CEA6B3E69CE3758227598991A0]
set sys(7.2.1-elm) [list 0x0d7c5a 0x0d7a72 0x71 0x1a5e4a 22761416 A9846DD76AEF86CEA6B3E69CE3758227598991A0]
set sys(7.2.1-tak) [list 0x114572 0x11438a 0x71 0x1e662a 23281729 A9846DD76AEF86CEA6B3E69CE3758227598991A0]
set sys(9.3) [list 0x10d0ee 0x10cdba 0x6c 0x06458e 27575632 325F14DAA33CC105AD841D8F73E3E67B7A85EDBF]
set sys(9.4) [list 0x10ebaa 0x10e876 0x6c 0x064bc2 28053712 325F14DAA33CC105AD841D8F73E3E67B7A85EDBF]
set sys(11.0) [list 0x114cf2 0x1149be 0x6c 0x1bc2fe 32115184 325F14DAA33CC105AD841D8F73E3E67B7A85EDBF]
set sys(11.0b) [list 0x115e4e 0x115b1a 0x6c 0x1bd402 32140016 325F14DAA33CC105AD841D8F73E3E67B7A85EDBF]
set sys(11.0c) [list 0x115d82 0x115a4e 0x6c 0x1bd672 32207760 325F14DAA33CC105AD841D8F73E3E67B7A85EDBF]
set sys(11.0d) [list 0x115d82 0x115a4e 0x6c 0x1bd672 32207760 325F14DAA33CC105AD841D8F73E3E67B7A85EDBF]
set sys(11.0g) [list 0x115adc 0x1157a8 0x6c 0x1bd3e4 32224332 325F14DAA33CC105AD841D8F73E3E67B7A85EDBF]
set addrA 0
set addrB 0
set addrC 0
set addrD 0
set brfsha 0
set tvapp 0



backed out the promo patch and vod now works thanks.

also verified that the pause patch is working.

so now the only issue is bufferhack

[whitepelican]

deleted...

[jt1134]

sorry bout bufferhack, used disassembly to port the patches, but forgot to add 2 bytes to each patch location to make sure the value is patched and not the actual instruction. fixed above. gotta love lunchbreak patch porting :P

[lgkahn]

verified new bufferhack works thanks.

3rd and last box updated in place sucessfully.

. if anyone needs a copy of my instructions an cannot find them on the site let me know..

now i have to pull one of the drives this weekend and do an image backup on my pc in case i loose a hard drive (which with 3 boxes usually happens once every year or two)

[tomhayes]

I'd really like to say this made sense to me, but even with this good information and all the "newbie" guides, I'm still lost.

I have the PROM and a 11.0d with tenet access and CCI patch. 11.0F got pushed to me and wiped my modifications. I restored from a backup and did the bootpage -P softwareupgrade=false thing, but otherwise I'm totally lost.
(I guess I could have flipped the bootpage switch and got back up and running in 10 minutes - but I didn't know that was an option until I read about 50 posts here.)

Does anyone have a "real" newbie guide? Because I be new :

(And thanks in advance - I mean it.)

11.0g
0x005d3788 "104000aa 100000aa"	//noencryption
0x00656c14 "30b000ff 00008021"	//cci1
0x00656c38 "00e08821 24110000"	//cci2
0x0077419c "00008021 24100001"	//backdoors
0x00868c44 "0d293985 00000000"	//nopromos
0x009bcc54 "12400003 10000003"	//deletethisrecording?
0x00b92f58 "14400026 10400026"	//30secskip
0x00b9761c "0c2e60fe 00000000"	//nopauseads
0x011478e0 "30b000ff 00008021"	//cci3

set sys(11.0g)     [list 0x115ade  0x1157aa  0x6c   0x1bd3e6  32224332  325F14DAA33CC105AD841D8F73E3E67B7A85EDBF]

[AlphaWolf]

In case anybody missed their master key, or hasn't been "selected" yet and wants to upgrade early:

11.0g-01-2 SWE_STA-14 bf decrypt key: 0x54488D360B38FF59

//static/SwSystem/11.0g-01-2/utils-162433048-1.slice.gz
//static/SwSystem/11.0g-01-2/GZcore-162433050-1.slice.gz
//static/SwSystem/11.0g-01-2/GZkernel-Gen06-162433056-1.slice.gz
//static/SwSystem/11.0g-01-2/GZhpk-Gen06-162433058-1.slice.gz
//static/SwSystem/11.0g-01-2/GZlocale-en_US-162433062-1.slice.gz
//static/SwSystem/11.0g-01-2/GZeiger-162433060-1.slice.gz
//static/SwSystem/11.0g-01-2/swsystem-162433066-2.slice.gz.bnd

[ScanMan]

I'd really like to say this made sense to me, but even with this good information and all the "newbie" guides, I'm still lost.

Does anyone have a "real" newbie guide? Because I be new :

You'll have to do a manual or in-place upgrade to preserve your hacks without pulling your drive. Everyone has their own way to do it.

There is an "installSw.itcl" script on the tivo that does the upgrade; essentially you edit that file to prevent the automatic reboot at the end of upgrade process which would otherwise wipe your hacks. The you re-hack your tivo, i.e., replacing the kernel, copying over hacks and rc.sysinit.author, fix the iptables firewall, patch tivoapp if you want at that point; then reboot.

One more thing, you can either patch tivoapp using the 'dd' method lgkahn illustrates or use the 'tvapppatch.tcl' method. tvapppatch is sort of the successor to the old superpatch.

There are a couple of gotchas so you should read and understand the process if you want to avoid pulling the drive. Check the "manual upgrade" link in my signature for my notes on this; although my notes were for an older version/tivo, the process is the same. I also have a automated script in that thread but you need to do a little setup to use it.

[whitepelican]

Nevermind. Scanman provided all the info you need above.

[ScanMan]

Posted a new "tvapppatches-11.0g.tcl" file (just nocso, backdoors) in the support thread to save people some time.

[lgkahn]

here are my notes hope it helps this is for in place upgrade..,

1. backup /var and tvbin and bin etc.. as you need to via ftp to a pc b4
doing the install

first got both kernels to make sure i have a hacked one saved
dd if=/dev/hda3 of=hda3vmlinux.px
dd if=/dev/hda6 of=hda6vmlinux.px

no diff on tivo so put them on pc


2. bootpage -p

root=/dev/hda4 dsscon=true console=1,115200 upgradesoftware=false

so new will be installed on 7 ...

3. now do upgrade
after copying installSw.sav back to installSw.tcl

cd /tvbin
remount
cp installSw.sav instalSw.tcl

./installSw.tcl 11.0-01-2-648

here was the output
(note make sure whatever installSw you run has the reboot line commented out.. this is key)


12/07:17:18:13: ./installSw.tcl: Installing "11.0-01-2-648".
Installing module utils
12/07:17:18:14: ./installSw.tcl: Executing updateroot /dev/hda /install /var/pa
ckages 11.0-01-2-648
Path prefix is /var/utils/
Sha1hash passed for updatekernel
Sha1hash passed for checkkernel.tcl
Sha1hash passed for messagelib.tcl
Sha1hash passed for buildskeleton
Sha1hash passed for SwInstall.tcl
Sha1hash passed for builddev

Searching /etc/fstab for current root

Old root is on /dev/hda4, new one goes on /dev/hda7

Creating new filesystem on /dev/hda7

Mounting new root filesystem on /install

Installing module core
Installing module hpk-Gen05
Installing module locale-en_US
Installing module eiger
Installing module kernel-Gen05
Building basic filesystem skeleton on /install


Checking /install/etc/fstab

newroot is 7, copying fstab from fstab.alternate
Creating symlinks for /install/etc files
Dismounting /install and checking its integrity


Initializing First Activation Date


Modifying bootparams to point to /dev/hda7

Creating upgrade messages
processing message file: /var/utils//messages/upgrade_73_ptcm.msg
found message
From = The TiVo Team
DateStr =
Date = 14220
Time = 62529
Subject = You have a new service update!
ExpireStr =
Expire = 14280
Priority = 1
Destination = 2
Frequency = 3600
MaxCount = 1
Body = Congrats! You've just received the Fall 2008 TiVo Service Update for your
TiVo DVR. This release reorganizes the TiVo Central menu, making it easier to
access Video on Demand content from TiVo and its partners. If your DVR is conne
cted to broadband, you'll be able to enjoy the latest movies, television shows,
and web videos directly from this menu.

Enjoy!

- The TiVo Team
creating message object...
processing message file: /var/utils//messages/upgrade_73_mb.msg
found message
From = The TiVo Team
DateStr =
Date = 14220
Time = 62529
Subject = You have a new service update!
ExpireStr =
Expire = 14280
Priority = 3
Destination = 1
Frequency = 8640000
MaxCount = 1
Body = Congrats! You've just received the Fall 2008 TiVo Service Update for your
TiVo DVR. This release reorganizes the TiVo Central menu, making it easier to
access Video on Demand content from TiVo and its partners. If your DVR is conne
cted to broadband, you'll be able to enjoy the latest movies, television shows,
and web videos directly from this menu.

There are many more changes 'under the hood' to support new features and service
s in the future. At TiVo we're always working to make your home media experienc
e the very best it can be!

Enjoy!

- The TiVo Team
creating message object...
Flipping root, setting boot parameters to 'root=/dev/hda7 dsscon=true console=1,
115200 upgradesoftware=false'

OK, reboot the system to use the new root filesystem

12/07:17:22:10: ./installSw.tcl: not Attempting reboot...
hdbrtivo:/tvbin$
hdbrtivo:/tvbin$



-------

4. now check boot stuff

hdbrtivo:/tvbin$ bootpage -p
No device name given, assuming /dev/hda
root=/dev/hda7 dsscon=true console=1,115200 upgradesoftware=false

seems ok


5. first put hacked kernel back to both partitions for good measure

hdbrtivo:/tvbin$ cd /var/hdkernel
hdbrtivo:/var/hdkernel$
hdbrtivo:/var/hdkernel$ ls
94hackedhdkernel
hdbrtivo:/var/hdkernel$
hdbrtivo:/var/hdkernel$ dd if=94hackedhdkernel of=/dev/hda6
8192+0 records in
8192+0 records out
hdbrtivo:/var/hdkernel$
hdbrtivo:/var/hdkernel$ dd if=94hackedhdkernel of=/dev/hda3
8192+0 records in
8192+0 records out
hdbrtivo:/var/hdkernel$
hdbrtivo:/var/hdkernel$

6. now put hacks


hdbrtivo:/tvbin$ mkdir /new
hdbrtivo:/tvbin$

hdbrtivo:/var/hdkernel$ mount /dev/hda7 /new
hdbrtivo:/var/hdkernel$


7. rc.sysinit.author

hdbrtivo:/new/etc/rc.d$
hdbrtivo:/new/etc/rc.d$ cp rc.sysinit rc.sysinit.sav
hdbrtivo:/new/etc/rc.d$
hdbrtivo:/new/etc/rc.d$ cp /etc/rc.d/rc.sysinit.author .
hdbrtivo:/new/etc/rc.d$
hdbrtivo:/new/etc/rc.d$

8. busybox or your tivo tools

hdbrtivo:/new$ tar -xvf BUSYBOX_1_00_PRE3.tar
busybox/
busybox/[
busybox/addgroup
busybox/adduser
busybox/ar
busybox/ash
busybox/awk
busybox/basename
busybox/bunzip2
busybox/busybox
busybox/bzcat
busybox/cal
busybox/cat
busybox/chgrp
busybox/chmod
busybox/chown
busybox/chroot
busybox/clear
busybox/cmp
busybox/cp
busybox/cpio
busybox/crond
busybox/crontab
busybox/cut
busybox/date
busybox/dd
busybox/delgroup
busybox/deluser
busybox/df
busybox/dirname
busybox/dmesg
busybox/dos2unix
busybox/du
busybox/echo
busybox/egrep
busybox/env
busybox/expr
busybox/false
busybox/fdisk

...

hdbrtivo:/new$
hdbrtivo:/new$

9. tivoftpd on other bin
hdbrtivo:/new/bin$
hdbrtivo:/new/bin$ cp /bin/mfs_uberexport .
hdbrtivo:/new/bin$
hdbrtivo:/new/bin$ cp /bin/remount .
hdbrtivo:/new/bin$
hdbrtivo:/new/bin$ cp /bin/s3tots .
hdbrtivo:/new/bin$
hdbrtivo:/new/bin$ cp /bin/tar .
hdbrtivo:/new/bin$
hdbrtivo:/new/bin$ cp /bin/tivoftpd .
hdbrtivo:/new/bin$
hdbrtivo:/new/bin$ ls


10. resolv.conf

hdbrtivo:/new/etc$ cp /etc/resolv.conf .


11. install sw... comment out the reboot in /tvbin and copy to installSw.tcl

hdbrtivo:/new/tvbin$ cp /tvbin/installSw.sav .


make sure you check permissions on executables also in /bin

ie

-rwxr-xr-x 1 0 0 95668 Dec 4 18:51 sz
-rwxr-xr-x 1 0 0 219248 Dec 7 17:31 tar
-rwxr-xr-x 1 0 0 66152 Dec 7 17:31 tivoftpd
-rwxr-xr-x 1 0 0 13960 Dec 4 18:51 top
-rwxr-xr-x 1 0 0 39336 Dec 4 18:51 umount


12. also one final check to make sure rc.sysinit.author is sound
ie cat /new/etc/rc.d/rc.sysinit.author


13. cp tivoapp and hack it

hdbrtivo:/new/sbin$ cd /new/tvbin
hdbrtivo:/new/tvbin$
hdbrtivo:/new/tvbin$ ls -al tivo*
-rwxr-xr-x 1 0 0 32115184 Dec 4 18:52 tivoapp
lrwxrwxrwx 1 0 0 7 Dec 7 17:19 tivosh -> tivoapp
hdbrtivo:/new/tvbin$
hdbrtivo:/new/tvbin$ cp tivoapp tivoapp.sav
hdbrtivo:/new/tvbin$

first 2 sare nocso and back door

next 3 are nocso
last is 30 sec
StageE_PreApplication

echo -ne "\x10\x00\x00\xaa" | dd conv=notrunc of=tivoapp bs=1 seek=1895284 // no cso
echo -ne "\x24\x10\x00\x01" | dd conv=notrunc of=tivoapp bs=1 seek=3598688 //backdoor
echo -ne "\x00\x00\x80\x21" | dd conv=notrunc of=tivoapp bs=1 seek=2433020
echo -ne "\x24\x11\x00\x00" | dd conv=notrunc of=tivoapp bs=1 seek=2433056
echo -ne "\x00\x00\x80\x21" | dd conv=notrunc of=tivoapp bs=1 seek=14123600
echo -ne "\x10\x40\x00\x26" | dd conv=notrunc of=tivoapp bs=1 seek=7912076 // 30 sec skip


above is for 11.0
below is for 11.0b
echo -ne "\x10\x00\x00\xaa" | dd conv=notrunc of=tivoapp bs=1 seek=1915420 // no cso
echo -ne "\x00\x00\x80\x21" | dd conv=notrunc of=tivoapp bs=1 seek=2451664 //following 3 are cci
echo -ne "\x24\x11\x00\x00" | dd conv=notrunc of=tivoapp bs=1 seek=2451700
echo -ne "\x00\x00\x80\x21" | dd conv=notrunc of=tivoapp bs=1 seek=14115792

echo -ne "\x24\x10\x00\x01" | dd conv=notrunc of=tivoapp bs=1 seek=3619700

above is backdoors

echo -ne "\x10\x40\x00\x26" | dd conv=notrunc of=tivoapp bs=1 seek=7934352

above is 30 sec



11.0c
disable enc
echo -ne "\x10\x00\x00\xaa" | dd conv=notrunc of=tivoapp bs=1 seek=1915412

backdoors

echo -ne "\x24\x10\x00\x01" | dd conv=notrunc of=tivoapp bs=1 seek=3619640

30 sec

echo -ne "\x10\x40\x00\x26" | dd conv=notrunc of=tivoapp bs=1 seek=7941092

cci
echo -ne "\x00\x00\x80\x21" | dd conv=notrunc of=tivoapp bs=1 seek=2453056
echo -ne "\x24\x11\x00\x00" | dd conv=notrunc of=tivoapp bs=1 seek=2453092
echo -ne "\x00\x00\x80\x21" | dd conv=notrunc of=tivoapp bs=1 seek=14147616


11.0d

echo -ne "\x10\x00\x00\xaa" | dd conv=notrunc of=tivoapp bs=1 seek=1915412
echo -ne "\x24\x10\x00\x01" | dd conv=notrunc of=tivoapp bs=1 seek=3619640
echo -ne "\x10\x40\x00\x26" | dd conv=notrunc of=tivoapp bs=1 seek=7941060
echo -ne "\x00\x00\x80\x21" | dd conv=notrunc of=tivoapp bs=1 seek=2453056
echo -ne "\x24\x11\x00\x00" | dd conv=notrunc of=tivoapp bs=1 seek=2453092
echo -ne "\x00\x00\x80\x21" | dd conv=notrunc of=tivoapp bs=1 seek=14139296

11.0g

echo -ne "\x10\x00\x00\xaa" | dd conv=notrunc of=tivoapp bs=1 seek=1914760
echo -ne "\x24\x10\x00\x01" | dd conv=notrunc of=tivoapp bs=1 seek=3621276
echo -ne "\x10\x40\x00\x26" | dd conv=notrunc of=tivoapp bs=1 seek=7941976
echo -ne "\x00\x00\x80\x21" | dd conv=notrunc of=tivoapp bs=1 seek=2452500
echo -ne "\x24\x11\x00\x00" | dd conv=notrunc of=tivoapp bs=1 seek=2452536
echo -ne "\x00\x00\x80\x21" | dd conv=notrunc of=tivoapp bs=1 seek=13924576
echo -ne "\x00\x00\x00\x00" | dd conv=notrunc of=tivoapp bs=1 seek=7960092

echo -ne "\x00\x00\x00\x00" | dd conv=notrunc of=tivoapp bs=1 seek=4623428
echo -ne "\x10\x00\x00\x03" | dd conv=notrunc of=tivoapp bs=1 seek=6016084

note i only do the first 7 not the nopromos which screws up the video on
demand
and not the last one cause i dont care about delete

there are in order

no encr.
backdoor
30sec skip
cci1
cci2
cci3
nopause
nopromos
delete this recording?

problem with no promos kills video on demand
the delete this .. gets rid of delete this recording message after
stopping near end

(subtract 0x400000 from patch file to get dd offsets)

14. remove bad reboot in busybox

dbrtivo:/busybox$ cd /new/busybox
dbrtivo:/new/busybox$
dbrtivo:/new/busybox$ ls re*
eadlink realpath reboot renice reset
dbrtivo:/new/busybox$
dbrtivo:/new/busybox$ rm reboot


15. as good measure comment out the installsw in
/new/etc/rc.d/StageE_PreApplication/rc.Sequence_500.CheckForSoftwareUpgrade.sh
(I dont bother with this anymore)

16. tytools


bash-2.02#
bash-2.02# cd /new
bash-2.02#
bash-2.02# mkdir usr
bash-2.02#
bash-2.02# cd usr
bash-2.02#
bash-2.02# cd /usr
bash-2.02#
bash-2.02# ls
tytools
bash-2.02#
bash-2.02# cd /new/usr
bash-2.02#
bash-2.02# mkdir tytools
bash-2.02#
bash-2.02# cd tytools
bash-2.02#
bash-2.02# cp /usr/tytools/* .
bash-2.02#
bash-2.02# ls
NowShowing mfs_stream tserver_mfs7_mips
NowShowing.tcl tserver
bash-2.02#
bash-2.02# ls -al
total 346
drwxr-xr-x 2 0 0 1024 Jan 6 17:49 .
drwxr-xr-x 3 0 0 1024 Jan 6 17:49 ..
-rwxr-xr-x 1 0 0 111784 Jan 6 17:49 NowShowing
-rwxr-xr-x 1 0 0 15162 Jan 6 17:49 NowShowing.tcl
-rwxr-xr-x 1 0 0 44380 Jan 6 17:49 mfs_stream
-rwxr-xr-x 1 0 0 124616 Jan 6 17:49 tserver
-rwxr-xr-x 1 0 0 48324 Jan 6 17:49 tserver_mfs7_mips
bash-2.02#
bash-2.02#
bash-2.02#
bash-2.02# pwd
/new/usr/tytools
bash-2.02#


THAT should be it and reboot and test and make sure /var is still there
after
reboot etc..


hdbrtivo:/new/etc/rc.d/StageE_PreApplication$
hdbrtivo:/new/etc/rc.d/StageE_PreApplication$ remount
Remount by AlphaWolf_HK
Root FS is now in read only mode.
hdbrtivo:/new/etc/rc.d/StageE_PreApplication$
hdbrtivo:/new/etc/rc.d/StageE_PreApplication$ reboot


after reboot run bufferhack11.tcl to reset buffer size and reboot again
remove old tivoapp to save space

[ScanMan]

here are my notes hope it helps this is for in place upgrade..,

Good explanation of the process; but IMHO that is a lot of typing and a lot of work. I literally run two scripts and reboot once. 95% of the 10 minutes this takes me I spend watching a script run, not typing. But as I said, to each his own; I know some people actually find it easier to pull the drive each time.

[mike_s]

not really for me.. i do in place upgrades and patch the new version of the tivoapp in the new partition b4 i ever reboot..

tvapppatch.tcl was designed to support that. You can point it to the binary you want to patch, specify the patch version to look for, and use it as part of an automated process.

Something like:

tvapppatch.tcl -v $(tail -n 1 /mnt/etc/build-version | awk '{print $2}') -t /mnt/tvbin/tivoapp -confirm no

I use a script to do upgrades, and just have to put the proper version patches in tvapppatches.tcl before running it.

[ScanMan]

tvapppatch.tcl was designed to support that. You can point it to the binary you want to patch, specify the patch version to look for, and use it as part of an automated process.

Exactly. After I do the in-place upgrade (via script), I just do

./tvapppatch.tcl -p ./tvapppatches-11.0g.tcl -t /mnt/tvbin/tivoapp

And then reboot; done. Same thing, just more explicit for those who don't understand the unix (tail, awk) stuff.

[lgkahn]

thanks post your scripts i will take a look .. but i like to have control in case it craps out.. it only takes me 5 minutes to doit.. except waiting for the 2 reboots.