Series 2 DIY (no scripts/ISOs) killhdinitrd walkthrough

[markfinn]

Series 2 DIY (no scripts/ISOs) killhdinitrd walkthrough

-or-

How I learned to stop worrying and love killhdinitrd.


After spending several days trying to figure out how to enable telnet and serial bash on my DirecTivo series 2 I was very frustrated... Anything I could find was either a how-to that used Sleeper's iso (which is outdated) and I couldn't find any info on how to use killhdinitrd, so here is a walkthrough of what I did for all you other newbies like me (Who are technically proficient. I will try to explain things, but you better understand linux and low level computer stuff). Everything here is a combination of info I gleaned from the web (mostly these boards) or guessed at based on my (limited) knowledge of the Tivo boot process.

Note that I am typing this from memory of what I did last night, so I might make some mistakes... If anyone who knows what they're doing notice a problem, or a better way than what I suggest, please follow up here.



To start with, I have a Philips DSR704 DirecTivo (series 2) running software 3.1.1c-01-2-301. Other series 2 boxes should be similar, but YMMV.


The end goal: telnet access to Tivo. From here you can add anything you want.


I used the following software:

Knoppix live linux CD I used version 3.4. I booted this CD to get a usable linux OS to do everything on.

mfstools allows backup/restore/copy/enlarging of the Tivo drives

pdiskx86 compiled, patched for use with Tivo's modified apple partition table. Knoppix doesn't have the neccessary kernel modifications to read Tivo's partition table, but this program can give you the offset/size of each partition on the disk, allowing you to mount it through loopback

killhdinitrd This nukes the Tivo anti-hacking features

Extra kernel modules I was using a linksys usb100m, which seems to need the rtl8150 module (not included on Tivo's drive). To tell the truth, I used the rtl8150.o available from this thread, but I assume the module from this whole package would be good too.





To start with I out the original Tivo drive (40Gig) and a new 160Gig drive in my office computer (removed my normal drive to make room...) do this however you want, but in the end you need both drives and a cdrom to boot Knoppix from. I had the original Tivo drive as ide chain 1 slave and the new drive as ide chain 1 master, making new=hda and old=hdb. However you attach yours, just make sure you change my commands below appropriately.

[Continued in next post due to 5000 char length limit]

[markfinn]

I booted Knoppix, used the web browser to get all of the software above, then opened a shell and became root (su, no password), unzipped/untarred things as neccessary, and started running commands.

The first thing I did was:
./mfstools backup -Tao - /dev/hdb | ./mfstools restore -s 127 -zxpi - /dev/hda

This took all of the data (including tv shows [streams]) from my original drive, copied it to my new drive, and enlarged the image (actually added new partitions and linked them into the MFS database structure) to fill my new 160 gig drive. By doing it this way I left my original drive completely un-touched, so that I have a backup, just in case. Be careful to get your drive assignments right. You don't want to accidentally overwrite your original. At this point you could stop the machine and remove the original drive for safety, but you will have to download things again (or for the first time if you plan ahead) as Knoppix only lives in ram. I actually used a USB flash disk to save utilities between reboots, but you don't need to. If you don't think you'll accidentally cat /dev/zero into your original drive, you may not need to reboot at all.

At this point you could quit, and you would have a new larger Tivo.

The next step on the way to bash access is to modify your startup scripts to start bash/telnet. Also, we will need to modify the kernel/inital_ram_disk so that the Tivo "security" measures don't wipe out our script changes. I believe that by default the kernel/ramdisk image contains a script/process that wipes out the drives and rebuilds them if modifications are detected. The kernel/ramdisk image is checked by the Tivo prom boot code to make sure that they are un-modified. We get around all of this by using killhdinitrd (originally developed for the HD Tivos, can also be used on certain SA and DirecTivo kernel images) to mess up the kernel/ramdisk image in such a way that is still passes the PROM signature checks, but is too broken for the initial ramdisk to be usable. The kernel itself is not modified. This allows us to modify the Tivo's drive without fear of being over-written by the code in the initrd.

To start with, I mentioned that Knoppix can't read the partition table from the Tivo drive. I used pdisk to get offset/sizes, dd'ed them to files on my machine, mounted/modified them as needed, then dd'ed them back. The steps I took were:

./pdisk --list /dev/hda

It gave:


Partition map (with 512 byte blocks) on '/dev/hda'
#: type name length base ( size )
1: Apple_partition_map Apple 63 @ 1
2: Image Bootstrap 1 4096 @ 77261888 ( 2.0M)
3: Image Kernel 1 4096 @ 77265984 ( 2.0M)
4: Ext2 Root 1 262144 @ 77270080 (128.0M)
5: Image Bootstrap 2 1 @ 77532224
6: Image Kernel 2 8192 @ 77532225 ( 4.0M)
7: Ext2 Root 2 262144 @ 77540417 (128.0M)
8: Swap Linux swap 260096 @ 77802561 (127.0M)
9: Ext2 /var 262144 @ 78062657 (128.0M)
10: MFS MFS application region 1048576 @ 78324801 (512.0M)
11: MFS MFS media region 33100800 @ 44161088 ( 15.8G)
12: MFS Second MFS application region 1048576 @ 79373377 (512.0M)
13: MFS Second MFS media region 44161024 @ 64 ( 21.1G)
14: MFS New MFS Application 1024 @ 80421953
15: MFS New MFS Media 232153088 @ 80422977 (110.7G)
16: Apple_Free Extra 5743 @ 312576065 ( 2.8M)


Which told me where to find my partitions.

Tivo keeps two sets of partitions around for upgrade purposes. I think you should try to determine which set of kernel/root partitions are active, make changes to that set, then write that set back to both active/inactive sets, but I was lazy. I found that only my partition 6/7 had anything useful in them (3/4 had no kernel signature and no mountable filesystem) so I just modified 6/7. I didn't even duplicate it onto 3/4 when I was done because I didn't know if my hacks were finished yet, but you can do whatever you want. Actually, now that I have bash access I suppose I could use dd right on the Tivo to copy over to the inactive partitions. One thing I don't know though... kernel partition 3 is only half the size of 6... can I just truncate partition 6 if duplicating to 3? Does anyone know? Anyone? Bueller?

[Continued in next post due to 5000 char length limit]

[markfinn]

If partitions 6 and 7 doesn't work for you, try 3/4... I knew (through repeated attempts) that 6/7 were my active partitions, so the following commands only reference them. You may need to work on 3/4 instead.

I ran:
dd if=/dev/hda of=tivokernel6 count=8192 skip=77532225 (fill in your numbers instead of mine)
./killhdinitrd tivokernel6
dd if=tivokernel6 of=/dev/hda count=8192 seek=77532225 (fill in your numbers instead of mine)


Watch for errors in there... if killhdinitrd doesn't work then you might have hit you inactive partition set instead of the active ones. The counts the seek/skip came from the length and base in the ouput of pdisk. Make sure you use the numbers from your pdisk output, not mine!
If this succeeds, you should now have a nuked initrd in your kernel image, meaning you can modify the drive without making Tivo's prom mad.


Next I ran:

dd if=/dev/hda of=tivoroot7 count=262144 skip=77540417 (fill in your numbers instead of mine)
mkdir /mnt/tivo
mount tivoroot7 /mnt/tivo -o loop=/dev/loop3

Tivo's partition table is weird, but its root partition is just ext2. This mounts your Tivo's root file system in directory t, you can go in and look around. In my following comments, I will not be including /mnt/tivo in my paths, although it will be implied, I will just refer to "Tivo's etc directory", or "Tivo's bin directory" so be sure you actually are in the right place.

When you are done making modifications to Tivo's root drive (described below) you can finish up and right the data back to the drive with:

umount /mnt/tivomnt
dd if=tivoroot7 of=/dev/hda count=262144 seek=77540417 (fill in your numbers instead of mine)

Modifying your root drive:

Do whatever you want. Seriously. It's a linux machine. My crappy instructions won't have meant much to you unless you had some idea what you were doing in linux anyway, so have at it. In order to enable serial and telnet bash, here's what I did:


I copied rtl8150.o into /lib/modules


I made an /etc/rc.d/rc.sysinit.author file with the following in it:

#/bin/bash

export PATH=$PATH:/var/hack/bin

insmod /lib/modules/usbcore.o
insmod /lib/modules/usb-ohci.o
sleep 5
insmod /lib/modules/rtl8150.o
sleep 5

ifconfig eth0 192.168.13.23 netmask 255.255.255.0
route add default gw 192.168.13.254 netmask 0.0.0.0 metric 1

tnlited 23 /bin/bash

/bin/bash < /dev/ttyS2 >& /dev/ttyS2 &


Remember to make rc.sysinit.author executable (chmod +x rc.sysinit.author)

rc.sysinit runs at boot up, calling rc.sysinit.author (if it exists). My one here doesn't do much other than load the usb 1.1 drivers and the rtl8150.o module. This was all I needed for the usb100m. If you have a different network adapter you might need a different set of modules, search around this board. Next the script configures my ethernet, starts the telnet server, and starts a bash console on the serial port.

The serial port was a big help to me. Make a cable with a DB9 on one end and a 3.5mm stereo phono plug on the other end. DB9 pin 5 goes to the sleeve in the phono, DB9 pins 2 and 3 go to ring and tip (I don't know which connects to which, I just tried one way, and it didn't work, so I swapped them. It was honestly faster to just try twice than to look for the right way on the net. Besides I have no idea where my multimeter is at the moment, and the headphone cord I cut up was very un-clear on which wire went to tip/ring. of course, ground/sheild was the sleeve). With the last line in rc.sysinit.author and this cable you can connect to the Tivo at 9600-8-n-1 and watch /var/log/messages and insmod things by hand if it doesn't go well.

umount your root image, dd it to the disk (as above), shutdown, put it in Tivo, plug it in, and cross your fingers. If you get lights (ANY lights) on your network adapter, then at least some of the modules loaded (otherwise the USB ports aren't powered). If you can ping Tivo, you have an eth0. If you can telnet in, wohoo! If not, make that serial cable and start debuging.


From here on there are a few things to notice:

Tivo mounts the drive read-only be default, to make any changes, do:

mount -o remount,rw /

To transfer stuff onto Tivo you can use rz over the serial link, but it doesn't work over telnet (I might look into that.. Others here mentioned that zmodem doesn't like TCP, but I've been using rz/sz through ssh for many years, so this somewhat bothers me) You may want to put tivoftpd.mips on the drive while it is still in your computer to ease this problem. (You did read these instructions fully before starting, right?) The ftp daemon and MANY useful utilities (chmod, joe, ping) are available at tivoutils.sourceforge.net.

Next you'll probably want tivoapp or mfs_ftp... I don't know yet, you've caught up to me.

[sirfergy]

Great tutorial!

If the 3.1.5d is truly rolling out to DirectTiVo2s I'll be sure to use this method once I get it.

[erhan]

You know, you could use the "revalidate" option in tivopart (comes from the same place you get pdisk from) and not have to deal with dd'ing the partitions in an out. Once the partition map is updated in memory, you can simply mount your tivo partitions, such as mount /dev/hda4 /mnt/tivo

[markfinn]

Wow, tivopart is a lot better. Thanks! I couldn't find it on the site with pdisk, but I did find it in this thread

I just booted my Knoppix disk again, ran "tivopart r /dev/hda" and was able to mount everything as advertised.... This is faster, easier, and didn't use 128 meg on my Knoppix ramdisk.

I am curious that on my system it didn't display/revalidate partitions higher than 13. I'm also amazed that a user process like this can mess with the kernel's memory. Definitely going to have to look through the source on that.

[cagey]

Originally Posted by markfinn

I ran:
dd if=/dev/hda of=tivokernel6 count=8192 skip=77532225 (fill in your numbers instead of mine)
./killhdinitrd tivokernel6
dd if=tivokernel6 of=/dev/hda count=8192 seek=77532225 (fill in your numbers instead of mine)

I'm very confused. What is the point of this. Can't I just run killhdinitrd from a floppy by typing "/floppy/killhdinitrd /dev/hdc6" I'm trying to learn, and I don't understand what the above quote is doing.

I'm trying to do this to a DVR80 with an upgraded hard drive of 120 gig, running 3.1.1c software.

Thanks for any help.

[Gromit]

Originally Posted by cagey

I'm very confused. What is the point of this [using dd to copy the kernel from and back to the TiVo drive]. Can't I just run killhdinitrd from a floppy by typing "/floppy/killhdinitrd /dev/hdc6" I'm trying to learn, and I don't understand what the above quote is doing.

markfinn went through those extra steps because he was using a Linux that couldn't "see" the Linux partitions on the TiVo drive. When that is the case, then you must use dd the way he did to copy off the kernel so killhdinitrd can modify it.

But read down to posts 5 and 6 for a pointer to the tivopart utility. Using its "revalidate" option enables your Linux to see the TiVo drive's partitions (and even mount the ext2 partitions). Then killhdinitrd can work directly on the kernel partiton, as you wrote. However, it's still a good idea to make a copy onto another drive so that a) you have a backup of your original kernel, and b) have a little more protection against making a mistake (like writing the wrong thing to the wrong partition).

tivopart's intended purpose is to enlarge several of the Linux partitions, but that requires extra steps. If you don't thoroughly understand that procedure, I recommend you save that for a later upgrade.

[cagey]

If I use MFSTools and killhdinitrd, do I need to modify the partions? I was able to run it on hdc6 (I think, I'm at work and can't check my notes) and I didn't get any errors stating it didn't work. But I wasn't able to get the rc.sysinit.author file to work. So I know I have more reading to do, but if I didn't get any errors running killhdinitrd, does that mean that part worked?

[Numbski]

Originally Posted by markfinn

/bin/bash < /dev/ttyS2 >& /dev/ttyS2 &

In regards to the above, I get the following in my /var/log/kernel:

syntax error near unexpected token `&'

Also, I'm not getting any networking. I have a Linksys USB200M, and I load the modules usbcore.o and usbnet.o. I think that's correct, but as I said, i get no networking and /var/log/kernel claims that eth0 doesn't exist. So I still have no bash and no networking.

[PlainBill]

Originally Posted by Numbski

In regards to the above, I get the following in my /var/log/kernel:

syntax error near unexpected token `&'

Also, I'm not getting any networking. I have a Linksys USB200M, and I load the modules usbcore.o and usbnet.o. I think that's correct, but as I said, i get no networking and /var/log/kernel claims that eth0 doesn't exist. So I still have no bash and no networking.

Well, one approach would be to make a serial cable (HowTos Only thread in Series 1 support forum) and look at the console output.

PlainBill

[NutKase]

Originally Posted by Numbski

In regards to the above, I get the following in my /var/log/kernel:

syntax error near unexpected token `&'

Also, I'm not getting any networking. I have a Linksys USB200M, and I load the modules usbcore.o and usbnet.o. I think that's correct, but as I said, i get no networking and /var/log/kernel claims that eth0 doesn't exist. So I still have no bash and no networking.

Not sure if it matters, and I'm sure I'll be corrected if it doesn't, but I'd take those spaces out.

I have:

/bin/bash </dev/ttyS2&>/dev/ttyS2&


NutKase

[Numbski]

I have a serial cable. I get no console output.