How to disable tystream encryption to enable extraction

[johnsolo]

You should put the 7.1a command up on the first post too

[Neevor]

I haven't seen a patch posted for 7.1b yet, so can someone check the following on a system with 7.1b?

All Values are Hex

Sw Version          Offset (VMA)     Original Value      New Value
7.1b                00691290         0320f809            3C020000

It seems to work on my SA2, ciphercheck.tcl reports "TyStream encryption is currently disabled", and a downloaded show seems to be fine.

Neevor

[ebeighe]

Originally Posted by 7.1

Here is the NoCSO patch for 7.1:

     vma       old         new
  6916c4: 0320f809 -> 24020000

converted to decimal file offset for dd:

echo -ne "\x24\x02\x00\x00" | dd conv=notrunc of=tivoapp bs=1 seek=2692804

my 7.1 (in particular, it says it is 7.1a-02-2-264) doesn't have the expected bytes at that offset. And probably coincidentally, the expected bytes show up 4 bytes sooner. I tried patching those bytes but that caused tivo to get stuck (says "wait" onscreen) forever. Are there different versions of 7.1a?

here is what my (unpatched) tivoapp looks like near decimal offset 2692804:

bash-2.02# hexdump -s 2692800 -n 16 tivoapp
02916c0 0320 f809 0000 0000 8fbc 0020 9662 000a

[7.1]

Originally Posted by ebeighe

my 7.1 (in particular, it says it is 7.1a-02-2-264) doesn't have the expected bytes at that offset.

7.1a != 7.1. Generally tivo seems to change this part of the software version number when tivoapp changes. 7.1a-01 and 7.1a-02 have the same tivoapp, so patches are compatible.

You'll find what you need here.

7.1b is out now and should be going out soon to most S2SA machines (but not the S2.5s). Neevor posted the nocso patch location for it a few posts back in this thread. I'd expect the other patches to port easily from 7.1a too.

[lenroc]

Originally Posted by Neevor

I haven't seen a patch posted for 7.1b yet, so can someone check the following on a system with 7.1b?

All Values are Hex

Sw Version          Offset (VMA)     Original Value      New Value
7.1b                00691290         0320f809            3C020000

Doesn't mesh with me. I've got 0x0060c821 at that VMA. The 0x0320f809 is at VMA 691294, though. This is a tivoapp from 7.1b-01-2-240. (My copy of tivoapp has never been run, if that makes a difference...)

[Jamie]

Originally Posted by lenroc

Doesn't mesh with me. I've got 0x0060c821 at that VMA. The 0x0320f809 is at VMA 691294, though. This is a tivoapp from 7.1b-01-2-240. (My copy of tivoapp has never been run, if that makes a difference...)

I match Neevor:

0x0069128c addiu  t9,t9,-1992
0x00691290 jalr   t9
0x00691294 nop

For comparison, here's the same section of 4.0.1b showing the original and replacement code (+ is new, - is old):

 0x00c38104 addiu  t9,t9,31712      
-0x00c38108 jalr   t9
+0x00c38108 move   v0,zero
 0x00c3810c nop

Just to make sure we're all looking at the same tivoapp, here's the md5sum of tivoapp-7.1b:

% md5sum tivoapp-7.1b
c73da179367e747f46318b33d953b028  tivoapp-7.1b

Size is 22051388. This is from 7.1b-01-2-264.

[lenroc]

This is a good time to state that I have no idea what I'm doing (I tend to think that's self-evident, though...)

Anyway, here's what I see:

tivo:/var$ hexdump -s 6886032 -n 8 tivoapp-7.1b
0691290 0060 c821 0320 f809
0691298
tivo:/var$ md5sum tivoapp-7.1b
c73da179367e747f46318b33d953b028  tivoapp-7.1b
tivo:/var$ ls -al tivoapp-7.1b
-rwxr-xr-x    1 0        0        22051388 Apr 28 20:03 tivoapp-7.1b

[Jamie]

Originally Posted by lenroc

This is a good time to state that I have no idea what I'm doing (I tend to think that's self-evident, though...)

You aren't properly converting hex vma addresses to file offsets. Here's a good tutorial.

If you did the vma to file offset translation right, you'd get this result:

% hexdump -C -s 2691728 -n 8 tivoapp-7.1b
00291290  03 20 f8 09 00 00 00 00                           |. ......|
00291298

[lenroc]

Got it. Sorry all.

I was actually using a hex editor on Windows to look at the offset. I must have had something else wrong though.

[gumbie]

I have followed the instructions to the letter (twice), with same results.. myworld program bailing with signal 11 and unit locking up at 2nd stage boot (Almost there, Just a few more minutes). I used the sequence for S2 user with SW Ver. 5.2... My unit is a Pioneer 810H-S running killed 3.1.5 kernel and software version 5.2.2-01-2-275. Is there an alternative to disabling the crypt? Main reason for hacking the tivo, was to be able to offload and edit out commercials on PC and create VCD, SVCD, and DVDs using PC based authoring software. Any help would be greatly appretiated. Please Respond to email removed.

Rick

edit by mrblack51: this is a public message board. if its a support question, the answers should be public

[numbchuck9191]

Been searching all morning with no luck. I want to unscramble the shows on my Philips 7000 Series 2 DirectTV which is running version 6.2-01-2-101 of the software. I can't find anything that says if noscramble.o will work with 6.2, nor what (or where) the latest verion of noscramble is.

In any event, I like AlphaWolf's approach better. Can someone please post the patch location and code for the 6.2 DirectTV version? The original post seems to have skipped that version.

Thanks, David

[Jamie]

Originally Posted by numbchuck9191

Been searching all morning with no luck. I want to unscramble the shows on my Philips 7000 Series 2 DirectTV which is running version 6.2-01-2-101 of the software. I can't find anything that says if noscramble.o will work with 6.2, nor what (or where) the latest verion of noscramble is.

As far as I know, noscramble.o is an obsolete technlogy that only applied to Series 1 units.

In any event, I like AlphaWolf's approach better. Can someone please post the patch location and code for the 6.2 DirectTV version? The original post seems to have skipped that version.

Hint: 'nocso' and your tivo software version are good search terms to find this.

See this link. It is also in the superpatch.

[johnsolo]

echo -ne "\x3C\x02\x00\x00" | dd conv=notrunc of=tivoapp bs=1 seek=2691728

Worked for me, that's all I'm saying.

[gudgolf]

In reference to the head of this thread, Will this procedure work on a unit (Samsung Sir4040) that has been hacked by Ptv "cake" and "net upgrade" ?

[pgoodell]

AlphaWolf jumps from Software Version 5.3 to 7.1 whatabout 6.2?