Page 2 of 9 FirstFirst 1234 ... LastLast
Results 16 to 30 of 127

Thread: 11.0n.H1-01-2-652 for Tivo HD

  1. #16
    Join Date
    Oct 2011
    Posts
    75
    I would greatly appreciate the right bootpage and the other files from lrhorer's script. I am not sure because I am reading this remote, if the versions posted on his fletcher site have everything he requires in the script page, but I can host the files on my server going forward if anyone wants to send them too me....Bootpage, etc etc. Just pm me and I will give an address and then we can have them there too.

  2. #17
    Join Date
    Jan 2011
    Posts
    55
    sanjonny:

    I was able to compile bootpage from source and use the tivopart x86 binary* from the packages on fletchergeek's website.

    I don't know what other tools lrhorer's script uses, but you really only need bootpage and tivopart to do the hacking... oh you would also need replace_initrd and the null initrd if you've never hacked the box before, otherwise you can just dd the old inactive kernel into place.

    * I intended to compile everything from source instead of using the included binaries, but ran into compilation problems with tivopart so just tried the included binary and found it worked.

  3. #18
    Join Date
    Aug 2011
    Posts
    83
    Kayle - Thank you very much for the great mini-guide. I must apologize for not being more responsive. I have come down with the flu and am kind of out of it right now. Will have to delay the hack attempt until I feel better and can concentrate. I do appreciate the responses very much. Will be ok in a couple of days and will probably have a couple of questions for you. Thanks again. svenn

  4. #19
    Join Date
    Aug 2011
    Posts
    83
    sanjonny - more than happy to upload whatever you need. Will PM you for upload directions. Not sure if I can just attach files to one of these posts? At any rate, I am dealing with a flu bug right now and spending most of my time in bed. Will be more in touch in a day or two. Thanks. svenn

  5. #20
    Join Date
    Jan 2004
    Location
    Noo Hampsha
    Posts
    765
    You can attach files to posts. If they're large, gzip or gzipped tar is best.
    Steve

  6. #21
    Join Date
    Oct 2011
    Posts
    75

    Boy should this make someone happy

    If you have a HD. I am about to make your day. Found a super easy way to do this. Was able to find my old files and all the setup I had done in the past with lrhorer's script so i have a tool if you want a total no brainer install. I will attach the files, but basically take this zip file, copy it to your root extract it and run tivo_hack and your done.

    There is some extra crud in here, i will post a better version later, but this is brainless. Want to know an even better thing I found, I was able to do it using the Ultimate Boot Cd (my version from 2013) so I had other tools if i needed them. Just copied this file to the ram drive, unzipped and ran it and done. Will post detailed steps later, but that was a nice hack to not have to install anything on my computer.

    This is for 11.n.h1.... for windows type machine anyway.
    Note, I upgraded the zip for latest 11n.kversion, new links below

    Attach tivo drive to your computer. I recommend you make a winmfs backup just in case. Put in ultimate boot cd or usb. I am assuming you know a little linux.

    For 11n.h
    http://www.theryanrealty.com/tivostuff/hacknew.zip

    alternate 11n.h
    http://www.theryanrealty.com/tivostuff/hacknewnh.zip

    new 11n.k
    http://www.theryanrealty.com/tivostuff/hacknew11nk.zip

    You can either download the zip to a usb drive, or access it from inside partition magic. I had copied it to a usb drive, but tried both ways.
    This includes all hacks from the first post in this thread, except the nomek. I stupidly did not include the nothanks hack last time, and thus HAD to pull my drive to user lrhorer's script, so just in case in the future, I am adding that one.

    Once it boots to the UCSB interface, select/boot to the Partition Magic interface. Its a mini linux install that will work. (provide more details later)

    you can transfer the zip now using file manager, or download it using firefox or whatever browser comes with the UBCD. Open a terminal window (there is an option somewhere to open a root terminal window)
    copy or move the hacknew.zip file to the top level root directory, which will be a ram disk. the easiest way to get there using terminal is to type cd \ or cd .. till you get to the top root level (not the /root/ directory, the script will not work).

    Unzip the hacknew.zip file
    Code:
    unzip -r hacknew.zip 
    or unzip hacknew.zip
    if you look using ls, you should now have a hack directory in the root. Switch to it.
    Code:
    cd hack
    now you can again ls to see if everything came out okay. Ready? Luckily lrhorer's script is so awesome it will check everything for you...
    now you are going to run tivo_hack and the magic will happen.
    Code:
    sudo hack_tivo
    If for some reason you need the password, on my UBCD the root password was partedmagic

    hopefully everything went okay. If it did, great....one more thing. (If using my zip, this was already copied to the drive when running the script so skip the rest of this paragraph, just shutdown the computer and place drive in tivo and boot)
    copy the RemoveCpiAll.tcl to your newly hacked tivo drive. i recommend putting it in var/hack. You will need to run it once you are all booted up and running to remove any protection that recorded with copy protection so you can download the files. You can use file manager to do this or thru linux commands. Also, this zip file will automatically set you up with TWP running on port 8080 and starting at boot (I think-verified). Once you have copied over the one removecpi script, close down the computer and boot the tivo. Yeah!

    Now that you booted up and its all wonderful, check that TWP works if you like that. It should be accessible thru your browser at the tivo ip address with port 8080 at the end. For example if the tivo is at 192.168.0.15, then 192.168.0.15:8080 will bring up TivoWebPlus. If not and it is running on port 80. You can load it and change it thru the interface in the hacks directory.

    Now to remove the pesky copy protection from the files that recorded after the update...

    If you used my zip file, the RemoveCpiAll.tcl fill is already on your drive.

    use putty or similar to access your tivo. Navigate to the hack directory...probably cd /var/hack and now run the script to remove copy protection
    First run the script will tell you what files it is going to work on.

    Code:
    RemoveCpiAll.tcl
    should give you a list of files that are copy protected, if it looks right the next step will remove them.
    Code:
    RemoveCpiAll.tcl ready
    After a bit, it should be done and you are all finished.

    A couple things with my setup. if you go to the var directory, you will notice a hack8080.tar. Every once in awhile my TWP gets nuked and I just copy this file back onto the var directory and extract it. I put it there in the install process so I can find it and move it somewhere else. you can just delete it or leave it there. If you ever accidentally screw up TWP, you can just extract it and have a nice clean copy of it. There might be some other files in the directory from my machine that you do not want. You can delete those also. I am just offering this because it made it super easy to update this time.

    I will clean this thread up a bit once I play around a bit more. Maybe we will never have to use this again, maybe not. Super kudos to lrhorer for his awesome script and all his and everyone elses help. I tried to post my zip file here, but I guess it was too big so I had to use my server address.

    I will play with the zip a bit and see if I can make it smaller, there might be redundant stuff in there, but if you want to get up and hacked quick, this is the easy way to do it.
    Last edited by sanjonny; 02-27-2017 at 09:23 PM.

  7. #22
    Join Date
    Jan 2011
    Posts
    55
    I disrecommend putting anything in /var as it can get wiped by the TiVo. Since I only install some basic tools and mfs_ftp, I can easily fit everything I need in the root file system, e.g. /hack.

    In the interest of helping basic TiVo hacking, I'm trying to boil down bootpage and tivopart into just the necessary stuff for basic TiVo hacking, basically, get active boot partition and get access to TiVo's partitions, respectively, hopefully small enough you could actually just type the code if necessary.

    So far, I've got the core functionality of bootpage down to a single line of shell code and less than ten lines of shell script with some sanity checking and dealing with byte-swapping (is byte swapping really necessary?). The tivopart distribution has a heck of a lot of cruft, dating back to running on a pre-OS X Mac, which can easily be torn out, my goal is to get "tivopart r /dev/sd?" down to a single page of code...

  8. #23
    Join Date
    Dec 2002
    Posts
    72
    I did the kernel hacking manually over telnet a few days ago. All is well and I'm pleased since most of the
    channels are mpeg4 here. I'm up to doing the tivoapp patches from the first post. It's been a while so I
    have forgotten what tools there are to automate this.

    Please remind me.
    Last edited by kmt; 09-18-2016 at 01:13 PM.

  9. #24
    Join Date
    Jan 2011
    Posts
    55
    There are several out there, but here's what I use:

    Code:
    bash-2.02# cat patch.apply
    #!/bin/sh
    while read addr odata pdata comment ; do
      # if address in hexidecimal, adjust and convert to decimal
      if [ "${addr:0:2}" = "0x" ] ; then
        addr=$(( $addr - 0x00400000 ))
      fi
    
      # extract existing data at address
      fdata=`dd if=tivoapp bs=1 skip=$addr count=4 2> /dev/null | hexdump -e "4/1 \"%02x\""`
    
      if [ "$fdata" = "$odata" ] ; then
        echo "$comment: Applying"
        # convert pdata to form usable by echo to convert to binary
        esc="\x"
        wdata=$esc${pdata:0:2}$esc${pdata:2:2}$esc${pdata:4:2}$esc${pdata:6:2}
        echo -ne "$wdata" | dd conv=notrunc of=tivoapp bs=1 seek=$addr 2> /dev/null
    
      elif [ "$fdata" = "$pdata" ] ; then
        echo "$comment: Already applied (skipped)"
    
      else
        echo "$comment: Mismatch (skipped)"
      fi
    done
    You can take the data supplied by psxboy then strip out the quotation marks, e.g.

    Code:
    0x005d2978 104000aa 100000aa	//noencryption
    0x00655e2c 30b000ff 00008021	//cci1
    ... more ...
    and feed that into the script, e.g.

    Code:
    bash-2.02# cd /tvbin
    bash-2.02# /hacks/patch.apply < /hacks/11.0n.H1
    Last edited by Kayle; 09-18-2016 at 08:25 PM.

  10. #25
    Join Date
    Oct 2011
    Posts
    75
    Quote Originally Posted by Kayle View Post
    I disrecommend putting anything in /var as it can get wiped by the TiVo. Since I only install some basic tools and mfs_ftp, I can easily fit everything I need in the root file system, e.g. /hack.

    In the interest of helping basic TiVo hacking, I'm trying to boil down bootpage and tivopart into just the necessary stuff for basic TiVo hacking, basically, get active boot partition and get access to TiVo's partitions, respectively, hopefully small enough you could actually just type the code if necessary.

    So far, I've got the core functionality of bootpage down to a single line of shell code and less than ten lines of shell script with some sanity checking and dealing with byte-swapping (is byte swapping really necessary?). The tivopart distribution has a heck of a lot of cruft, dating back to running on a pre-OS X Mac, which can easily be torn out, my goal is to get "tivopart r /dev/sd?" down to a single page of code...
    I basically just copy what is in var, zip it and if it ever gets wiped, i can ftp it back in. I have to check, but lrhorer's script puts some tools somewhere where ftp and putty access still work when var gets wiped, so the other stuff in var is not critical....Well TWP is critical to me, but I can just put it back in var/hack if it gets wiped. I know there is lots of talk about putting it in other places/slices/whatever, but I don't know enough about where to copy it to and what is safe to put it and where is not safe, and I have not had time to research that for a few years. Maybe someone can give me a condensed version.

    I only put my above setup, so just in case we have to go thru this again, I have an easy way to do it, and for me, being able to do it off the ucsb cd made life much easier!. I am better than a rookie tivo hacker, but definitely not much higher than that, so I have to use wonderful tools like lrhorer's script and his advice.

  11. #26
    Join Date
    Jan 2011
    Posts
    55
    I guess the question is: how big is TWP? If I'm looking at the right distribution, it looks like it's under a megabyte, which would have no problem fitting on the root partition where it won't get wiped out. The main problem is to make sure it doesn't need to write any files on root (which should be read-only), a good idea in any case. The default for mfs_ftp requires it reside on a writable partition but a little adjustment fixed that.

  12. #27
    Join Date
    Apr 2002
    Posts
    884
    Attached is the tvapppatch script which was generally used when this forum was active.
    I've also attached tvapppatches.tcl which is used by the first script. That file incorporates most of the patches for 11.0nH1 offered by the OP in this thread. It leaves encryption alone, I MRV with a Roamio.

    FTP both files to var run tvapppatch (./tvapppatch) wait until it completes then reboot your tivo for it to take effect.

    Edit the second script, using the values in the first post, if you want to add or delete options.

    I think you can run the script against the non-running tivoapp if you want to hack the new version before the upgrade finishes.

    edited to add: system didn't upload patch since I had previously uploaded patch for previous version. Will upload correct one later todayu
    Attached Files Attached Files
    Last edited by newbie; 09-24-2016 at 08:54 AM.

  13. #28
    Join Date
    Aug 2012
    Posts
    12
    psxboy,
    I see in the past you've posted the manual commands for hacking the tivoapp:
    Code:
    11.0m
    echo -ne "\x10\x00\x00\xaa" | dd conv=notrunc of=tivoapp bs=1 seek=1912332
    echo -ne "\x00\x00\x80\x21" | dd conv=notrunc of=tivoapp bs=1 seek=2450112
    echo -ne "\x24\x11\x00\x00" | dd conv=notrunc of=tivoapp bs=1 seek=2450148
    echo -ne "\x24\x10\x00\x01" | dd conv=notrunc of=tivoapp bs=1 seek=3616368
    echo -ne "\x00\x00\x80\x21" | dd conv=notrunc of=tivoapp bs=1 seek=13117088
    echo -ne "\x10\x00\x00\x03" | dd conv=notrunc of=tivoapp bs=1 seek=5979176
    echo -ne "\x10\x40\x00\x26" | dd conv=notrunc of=tivoapp bs=1 seek=7927132
    echo -ne "\x00\x00\x00\x00" | dd conv=notrunc of=tivoapp bs=1 seek=7945248
    Would you be willing to post these for 11.0n.H1? I normally wouldn't ask, but I'm trying to do this without removing my drives, and I can't seem to figure out the math where you're getting the "seek="

    I looked at just doing a hex conversion, but that doesn't fly...

  14. #29
    Join Date
    Aug 2012
    Posts
    12
    Hold on, I may have figured it out. Would you confirm my math?

    Code:
    Example FORMULA: 005d2978 - 400000 = Hex value: 1D2978 Decimal value: 1911160
    Which gives us the following:
    Code:
    echo -ne "\x10\x00\x00\xaa" | dd conv=notrunc of=tivoapp bs=1 seek=1911160
    echo -ne "\x00\x00\x80\x21" | dd conv=notrunc of=tivoapp bs=1 seek=2448940
    echo -ne "\x24\x11\x00\x00" | dd conv=notrunc of=tivoapp bs=1 seek=2448976
    echo -ne "\x24\x10\x00\x01" | dd conv=notrunc of=tivoapp bs=1 seek=3616576
    echo -ne "\x00\x00\x80\x21" | dd conv=notrunc of=tivoapp bs=1 seek=13139924
    echo -ne "\x10\x00\x00\x03" | dd conv=notrunc of=tivoapp bs=1 seek=5655072
    echo -ne "\x10\x40\x00\x26" | dd conv=notrunc of=tivoapp bs=1 seek=7981028
    echo -ne "\x00\x00\x00\x00" | dd conv=notrunc of=tivoapp bs=1 seek=7999144

  15. #30
    Join Date
    Jun 2003
    Posts
    611
    Yep, that's right: subtract 0x400000 from the disassembly address and convert to decimal. Your numbers are correct.

    -psxboy
    TCD652160 TivoHD
    1TB
    11.0n.J1-01-2-652

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •