Scrambling Issues: Archiving, Restore & Decrypting scrambled recordings

[rc3105]

this thread is to discuss scrambling issues & provide information + utilities so you can use your recordings the way you want to

currently the only format to save/restore scrambled recordings is tmf

Archiving: use mfs_ftp to extract as tmf. be sure to backup the tivo DiskConfigurationKey (DC_key.xml) with the get_DC_key.tcl utility

Restore: use mfs_ftp or mbm's import.tcl to restore tmf archives

Decryption: a restored scramble is identical to an original scramble (mfs_ftp will restore the xml scramblekeys, you have to make sure the DiskConfigurationKey is correct)


Limitations: currently 3 things must match to play or decrypt a scrambled recording

1) CommercialSkipOffset keys (stored in ty+ or tmf archives)

2) tivo hard drive DiskConfigurationKey

3) tivo motherboard crypto chip

if the DiskConfigurationKey has changed for any reason (re-imaged the drive - sw update - clear & delete) the correct DiskConfigurationKey (DC_key.xml) must be restored

the attached utilities backup, restore & clear the diskconfiguration keys (clearing the DC key fixes error #51)

[rc3105]

this particular info is somewhat obsolete but still good to know - see The rules for scrambling have changed for both S1 and S2 units. for the latest & greatest

S1 standalone: doesn't scramble recordings

S1 dtivo: use noscramble.o


S2 - depends on software version

3.x - "kmem 800b23b4 00001021" in a startup script

4.0 - kmem 800bf958 00001021 in a startup script AND patch tivoapp address 8275016 to hex 24 02 00 01

4.01 - kmem 800bf958 00001021 in a startup script AND patch tivoapp address 08300072 to hex 24 02 00 01

*i think these 4.x values are right, MuscleNerd & NutKase provide more detail later in the thread

5.x - unknown so far?

[rc3105]

Originally posted by ScrambleThis
This may be of some interest.

Attachment: unscram.zip

thanks ScrambleThis, keep up the good work

renamed a bit for clarity - READ the included readme!!!

ONLY works with S1 dtivos

if unscramble.o doesn't work for you clear your browser's cache & download it again

[Will]

Originally posted by rc3105
whoops, accidently deleted the thread, rebuilding...

(if anybody with a copy of the thread / posts feels like attaching it to a post here that'd be great - would save SO much typing...)

Here's one I archived:

Dummies guide to decrypting your Tivo
originally posted by rc3105, slightly edited

1. Disable noscramble or autoscramble in your startup scripts, Xplusz, wherever

2. Reboot

3. Install unscramble.o (if using the precompiled, make sure you have the correct version). Unscramble.o can be put anywhere; if you're doing a one-time salvage of old files with mfs_ftp, I'd just put it in the mfs_ftp folder

4. Run unscramble with "insmod unscramble.o" directly from it's resident folder or by pathname. Add the command to a script if desired

Having done the above, unscramble is now active. To salvage your old scrambled files:

5. Watch the first few seconds of the show to be extracted

6. Extract that show normally as tmf, via mfs_ftp. You can extract to the same Tivo or anywhere else; the new file you have just created is not scrambled and is portable

7. Repeat #5 and #6 as needed

8. Once everything is archived, restore your Tivo to it's original condition by re-enabling noscramble or autoscramble as you originally had it set up, then rebooting

9. Verify the extracted files play properly. If you have copied the new files back onto the original Tivo, you'll need to have done step #8

10. Delete the old scrambled files

[bcc]

I've successfully descrambled&offloaded some recordings to unix without ethernet on the tivo. Roughly:

0. Load unscramble.o module
1. Modify imporstream.tcl to take stream size from command line instead of expecting it from a file
2. Modify mfs_import to not attempt slop skipping at beginning of stream
3. Run importstream.tcl to create new-fsid
3. Run mfs_stream -s <old-fsid> > fifo
4. Run mfs_import <new-fsid> fifo
5. Move tivo disk(s) to linux
6. mfs_export <new-fsid> <output-file>.ty

A bit involved, but OK for one time offloading of scrambled content.

[ronnythunder]

Originally posted by bcc
A bit involved, but OK for one time offloading of scrambled content.

dang man, get a turbonet already!

ronny

[bcc]

Originally posted by ronnythunder
dang man, get a turbonet already!

ronny

I should have done that a year or so ago At this point I'm just planning on replacing the box with an HD directivo in a few months, so I don't think it'll be worth it. Hopefully it won't take long for turbonet or the like to be figured out for the HD box.

[NutKase]

Originally posted by rc3105
S1 standalone:

doesn't scramble recordings


S1 dtivo:

use noscramble.o


S2 dtivo: (hdvr2 & such)

3.x sw - needs "kmem 800b23b4 00001021" in a startup script

4.x - needs kmem AND a patch to tivoapp

(anyone want to volunteer details?)


S2 sa:

anyone? beuhler?

The kmem addresses and tivoapp patches are not tivo type specific as you laid them out. So, the S2 SA category is the same as the S2 dtivo 4.X categories for our purposes.

[EDIT] MuscleNerd, Thanks for pointing out how I confused everyone by not posting the 4.0 patch location and jumping to the 4.01 patch.


The 4.0 and 4.01 kmem info is as follows.

You need to run kmem from a startup script (or patch your kernel since this is possible when running monte.)
/path/to/kmem 800bf958 00001021


To watch your newly unscrambled recordings you also must patch your tivoapp. MuscleNerd has found and posted the patch address for 4.0 and this is referenced in the first post in this thread. I found the patch address for 4.01 (thanks for MuscleNerd leading the way) and fully describe it in my post here

[EXCERPT]
Just for the newbies. Telnet into your tivo, change to /tvbin
back up your current tivoapp then make a copy to edit with:

cd /tvbin
cp tivoapp tivoapp.scrambled
cp tivoapp tivoapp.unscrambled

then run this printf command, as in, type this exactly:

For 4.0
printf "\x24\x02\x00\x01" | dd conv=notrunc of=tivoapp.unscrambled bs=1 seek=8275016

For 4.01
printf "\x24\x02\x00\x01" | dd conv=notrunc of=tivoapp.unscrambled bs=1 seek=08300072

then:

cp tivoapp.unscrambled tivoapp
chmod 755 /tvbin/tivoapp(just in case although you shouldn't need it.)

this should work and allow you to do it via telnet while the tivo is cranked up.

Alternatively, you can fire up your hex editor and go to 8275016 for 4.0 or 08300072 for 4.01 and change the 0320 to 2402

NutKase

rc3105: Are these the 'details' you had in mind? I hope it helps.

[RisingPhoenix]

I have a virgin tivo disk with hours of show's I want to extract but I know the shows are scrambled so I'm trying to find a path to both hack my vigin disk and unscramble my shows. If this is a solved issue, someone please point me to the correct post, if not, here are my thoughts.

If a tivo that's been hacked to not scramble can also convert scrambled data to unscrambled data, as per Dummies guide to decrypting your Tivo originally posted by rc3105, and it's posible to use Sleepers ISO to backup and restore the entire disk using mfsbackup, would that allow the existance of a hacked tivo with scrambled shows? If so then could that tivo also unscramble the shows?

RisingPhoenix

[ronnythunder]

nobody has published a method to decrypt on any s2 units yet. maybe with the s1 stuff out, somebody will come up with something.

ronny

[MuscleNerd]

Originally posted by rc3105
4.x - needs kmem AND a patch to tivoapp
(anyone want to volunteer details?)

The 4.0+ tivoapp basically does a litle crypto check after it closes a stream, to verify that it was really encrypted by the system call. I'm guessing they did that as a direct response to the noscramble.o module or kmem approaches.

So the tivoapp patch disables that final check. If you don't patch tivoapp, you'll find that the tyfile is not being scrambled because of the kmem patch...and everything looks good until the stream is closed. At that point, tivoapp realizes that it didnt go as planned, and it refuses to play the stream. It's still there unscrambled, though.

[mory]

I have a DTivo (Hughes) with Airnet. I spent ages trying to figure out all the different noscramble, unscramble, etc options. I read about the option of loading unscramble, then MFS_FTP'ing everything off your TiVO then loading noscramble and uploading it all back.

The bottom line is, why can't you just leave unscramble running and let your TiVo just keep recording scrambled? When you want to extract files, you simply have to play them for 1 second... then extract them. This works fine and requires the minimum amount of modification to your TiVO.

I feel like I am missing something. Is it just the general desire to not want to have your shows recorded scrambled (even though you can very easily unscramble them as you extract). Or is it the problem of having to play a bit of each clip before you extract (keeps you from being able to do everything remotely). Or are people experiencing other issues that I'm not thinking of.

Thanks

[genepool]

I feel like I am missing something

Yes, you are . The method being discussed here is for people who have shows that were recorded scrambled and now want them unscrambled.

i.e. you recorded shows, then discovered you can hack the tivo, and now need to unscramble your previous shows.

[mory]

Originally posted by genepool
Yes, you are . The method being discussed here is for people who have shows that were recorded scrambled and now want them unscrambled.

i.e. you recorded shows, then discovered you can hack the tivo, and now need to unscramble your previous shows.

I should have made this clear... this is exactly my situation. I have had my TiVo for awhile, so everything is scrambled. Just recently got the Airnet and started playing with it. When I FTP the .TY files off it I have UNSCRAMBLE.O loaded. This pulls the files off unscrambled so I can burn DVDs.

I keep UNSCRAMBLE.O loaded at all times. My understanding is this still keeps recording stuff scrambled. So everything I pull off, whether recorded a while ago or now is going to be scrambled... but descrabled on the extract.

What's the problem with that? People are going through crazy hoops to avoid recording more stuff scrambled.

[ronnythunder]

mory, i think that the "craze" to have things unscrambled is because having things *recorded* uinscrambled used to be the only way to extract them prior to scramblethis' post.

assuming that the doc is correct (and the code seems to bear it out) in that normal tivo i/o is unaffected by unscramble.o, i don't see any reason why you couldn't do what you suggest. in fact, if i had a tivo with nothing but scrambled shows on it, it's probably what i would do.

as you said, the downside is having to play the stream a little, but you can do that with the "screen" tivoweb module, so it is possible to do the whole thing remotely.

ronny