Problem:
How do I hack my Series 2 TiVo?
Versions:
TiVo software versions 4.0 and up
Solution:
This is merely an outline of
how to hack your Series 2 DirecTiVo or stand alone unit. New hacks are literally created every day, so this format will best allow me to easily make any updates as preferred hacking methods change. External links are provided for step-by-step information. You'll notice most of the links will take you to the
DealDatabase Forum, which is probably the best source of information for hacking your TiVo.
Introduction
Hacking TiVo's is not for the lighthearted. If you just learned how to turn on your computer a few days ago, you will find this extremely difficult. If you have upgraded your computer's hard drive and know your way around the command prompt, you'll have an easier time of it.
TiVo uses the Linux operating system on a MIPS processor. We will be using the command prompt exclusively. Some Windows commands are the same in Linux, while others are different, but work the same as in Windows. Some Linux experience is very helpful, but not absolutely necessary. There are some subtle differences between Linux running on a PC and the version that runs on the TiVo.
Please realize that by merely opening your TiVo your warranty will be null and void. Before you begin, make sure there is nothing recorded on the Tivo (Now Showing) that you can't live without. Also, write down your Season Passes, Wishlists, one-time recordings (check the To Do list), and any other settings you think you might need in case you toast your TiVo. If you only have one computer and wish to minimize reboots and reconnecting drives, be sure to read through this first, print out the relevant information, and download the necessary files before getting your hands dirty.
USB Network Adapter
In order to access your TiVo from your home network, you'll need to pick up a USB network adapter. A USB 2.0 adapter will typically set you back about $30. The bigger the brand name, the less trouble you'll have getting it to work. Recommended brands include Linksys and D-Link. It's also possible to use a Wi-Fi USB adapter with a few more tweaks that I will NOT cover here.
The TiVo does not have any security whatsoever. Anyone who can get to its IP address will have full access to the filesystem, and can view, record, and delete your shows, Season Passes, etc. Make absolutely certain your TiVo is behind your router's firewall. No external ports should be forwarded to the TiVo's IP address, nor should it be in the DMZ.
The TiVo Replacement Hard Drive
You'll also need a hard drive to replace the original drive in the TiVo. This should be bigger than the original. Yes, you can just hack the original drive, but what if something goes wrong? What if your hacks take longer to apply than expected, and you (or other family members) would just die if you missed your favorite TV show? Large capacity drives are becoming cheaper and cheaper any more, so there really is no excuse to not purchase one. If you have an extra drive lying around that you are planning on using, all existing data will be destroyed.
The Second Drive
Now you'll need a second storage device that will we need to copy files back and forth on the new TiVo drive. It can be another hard drive or a flash memory drive (a.k.a. USB, thumb, jump drive, etc.). If you are planning on backing up your TiVo, it will need to be formatted in FAT or FAT32, and large enough to hold the backup image...2GB is recommended. (Linux cannot write safely to NTFS.) If you are going to simply restore an image, then an NTFS-formatted drive will work too...just keep in mind you will not be able to write to that drive. While it is possible to use flash memory drives, they are often slow and sometimes unreliable. A small capacity hard drive is really recommended.
On this second drive, you'll need the killhdinitrd program, a virgin kernel, and the All-In-One S2 Utilities Collection (tivotools). Here's how to get them...
- Download the killhdinitrd*.zip file at the end of the first post.
- You'll need a virgin kernel to apply the killhdinitrd patch. The first post also has information as to which version of the kernel you can use for your particular TiVo. Kernel files are a bit difficult to come by lately. Kernels are available on the LBA48 Enhanced CD ($5). The CD image will also come in handy for the next section. If you are on a budget, check out the Backup image and slice begging thread. Download sites frequently appear and disappear, so especially check out the last few posts.
- Download tivotools.tar.rar at the end of the first post.
Unzip the killhdinitrd*.zip file and copy the files over to your second drive. The virgin kernel file should be called vmlinux.px. Copy that over to the second drive. If the kernel file you downloaded ends with a .tar or .gz extension, it is compressed using a Linux compression format. For simplicity, uncompress these files before you copy them over to the secondary drive. I recommend using
7-Zip as it supports all the compression formats listed in this guide.
Create a folder on your second drive called
tivo-bin. Then, un-RAR tivotools.tar.rar. Now, un-TAR the tivotools.tar file. Copy the resulting files over to the tivo-bin folder. Again,
7-Zip will handle this task flawlessly.
Linux Boot CD
You'll also need to burn a CD image that will boot your computer into Linux. I recommend using the
LBA48 boot CD at ptvupgrade.com. The free one is adequate.
Tyger's MFS Tools CD will work too, but it is a bit dated and will not allow you to run the bootpage commands until after you replace the drive in your TiVo.
Hinsdale How-To
You should have everything you need now. Let's get our hands dirty! Follow the
Hinsdale How-To. This is an excellent guide for backing up and restoring the TiVo software to a larger drive. If you using USB hard drive enclosures, external drives, or flash memory drives, you can mount /dev/sda1, /dev/sdb1, etc. Be sure to test that your new hard drive works in your TiVo before continuing. For DirecTiVo owners, you might want to force a few calls because this is the last chance it will have to update itself. Allowing a DirecTiVo to call in after it is hacked is not recommended. If you lose your local channels, check out this
tip.
killhdinitrd
We're not done with the Linux boot CD, so don't put it away just yet. Whenever the TiVo starts up, it scrubs the hard drive of files that shouldn't be there. Modified files are replaced with the originals. Obviously, you want your hacks to be there whenever the power goes out. Fortunately, there is a program to kill this hdinitrd process called killhdinitrd.
Put your TiVo drive back in your PC and boot into Linux with your CD. Mount the partitions using the commands below considering the drive with killhdinitrd is Primary Master (master drive on the first IDE channel or /dev/hda in Linux) and the TiVo drive is Secondary Master (master drive on the second IDE channel or /dev/hdc in Linux).
mkdir /mnt/varmkdir /mnt/dosmount /dev/hdc9 /mnt/varmount /dev/hda1 /mnt/doscp /mnt/dos/vmlinux.px /mnt/var/mnt/dos/killhdinitrd /mnt/var/vmlinux.pxThese commands should mount the /var partition on the TiVo drive, copy the vmlinux.px file over to it, and run killhdinitrd on the kernel. Follow the on-screen prompts to patch the kernel file. Once that is done, apply the kernels to the two root partitions...
dd if=/mnt/var/vmlinux.px of=/dev/hda3dd if=/mnt/var/vmlinux.px of=/dev/hda6Step-by-step instructions are available in the
killhdinitrd support thread. We've gone through the first 4 steps, so start with #5. Note the bootpage commands will not work with the old MFS Tools boot CD. You will have to issue the commands from a telnet session when we get to that point. They are very important in case TiVo issues a software upgrade. A software update will delete your hacks without notice, so it is best to prevent updates until you are prepared.
All-In-One S2 Utilities Collection
The TiVo software has very few commands built-in. This where the tivotools file that we downloaded earlier comes in. With your TiVo drive still in your PC and booted up in Linux, we need to mount the root partitions. The TiVo has two root partitions with one being the primary partition. Whenever TiVo downloads and installs a software update, it does so on the alternate partition. If something goes wrong with the software update, the TiVo can still boot up with the other partition. Clever, huh? Unless you were able to use the bootpage commands in the previous section, it is difficult to know which root partition the TiVo currently boots with. At any rate, we are going to copy the All-In-One S2 Utilities over to both.
mkdir /mnt/hdc4mkdir /mnt/hdc7mount /dev/hdc4 /mnt/hdc4mount /dev/hdc7 /mnt/hdc7mkdir /mnt/hdc4/tivo-binmkdir /mnt/hdc7/tivo-bincp /mnt/dos/tivo-bin/* /mnt/hdc4/tivo-bincp /mnt/dos/tivo-bin/* /mnt/hdc7/tivo-binSo what we did was mount the 4th and 7th partitions on the TiVo drive. Then we created a tivo-bin directory on both, and copied all the tivo-bin files over. This is per the instructions in the
All-In-One S2 Utilities Collection thread. The "cpio" command will not work from the boot CD which is why you should un-RAR and un-TAR while in Windows.
Networking
For whatever reason, your TiVo box is programmed only to talk to the TiVo servers, not other computers on your local network. Of course, we are going to change that. Enter these commands...
cp /mnt/hdc4/etc/netfilter-enable /mnt/hdc4/etc/netfilter-enable.bakcp /mnt/hdc4/etc/netfilter-disable /mnt/hdc4/etc/netfilter-enablemv /mnt/hdc4/sbin/dhclient /mnt/hdc4/sbin/dhclient.bakcp /mnt/hdc7/etc/netfilter-enable /mnt/hdc7/etc/netfilter-enable.bakcp /mnt/hdc7/etc/netfilter-disable /mnt/hdc7/etc/netfilter-enablemv /mnt/hdc7/sbin/dhclient /mnt/hdc7/sbin/dhclient.bakThat should take care of the networking filters on both root partitions. If you receive any errors, don't worry. It just means there is an older software version on that partition that doesn't have the filters in place. If you want to enable DHCP, do not enter the dhclient commands (renames the dhclient). Your router will automatically assign your TiVo an IP address. You'll have to go into your router, though, to see what IP address it assigned your TiVo box in order to access it.
rc.sysinit.author
I know you are eager to re-insert this drive back into the TiVo and see the fruits of your labor, but there is one more step. We need to create a startup script to run some stuff when the TiVo boots. Issue this command to create and edit the rc.sysinit.author file:
vi /mnt/hdc4/etc/rc.d/rc.sysinit.authorThis starts up the VI editor. I'm not going to tell you how to use it as there are many, many websites that explain the VI editor in detail. Do a
search.
Here is what my rc.sysinit.author looks like which you can copy:
export PATH=$PATH:/tivo-bin#start bash/bin/bash /dev/ttyS2&#set the IP addressifconfig eth0 192.168.1.90 broadcast netmask 255.255.255.0route add default gw 192.168.1.1 netmask 255.255.255.0 metric 1#start telnet servertnlited 23 /bin/bash -login &#start ftp servertivoftpdsleep 500#run fakecall/var/hack/fakecall.tcl#start tivowebplus/var/tivowebplus/tivoweb#start mfs_ftp/var/mfsftp/mfs_ftp.tclBash and telnet are already on the TiVo. Tivoftpd is part of the All-In-One S2 Utilities Collection, the path of which we've included in our path statement. If necessary, change the IP address of 192.168.1.90 to whatever you want your tivo to be. The gateway address of 192.168.1.1 should be the same as your router. If you did not rename dhclient earlier, you can delete or comment out these lines. Note we haven't installed fakecall, tivowebplus, or mfs_ftp yet. TiVo will attempt to find the files, but will fail, and just skip down to the next command.
When you are done, copy the rc.sysinit.author file over to the other root partition...
cp /mnt/hdc4/etc/rc.d/rc.sysinit.author /mnt/hdc7/etc/rc.d/and set them as executable...
chmod +x /mnt/hdc4/etc/rc.d/rc.sysinit.authorchmod +x /mnt/hdc7/etc/rc.d/rc.sysinit.author
Telnet & FTP
Remove the TiVo drive from your PC, and put it back in the TiVo. Plug the TiVo back in and cross your fingers. If all goes well, you should be able to telnet to the IP address of the TiVo (ex., Start--Run--telnet 192.168.1.90 <Enter>) as well as FTP.
Ok, before we forget, we need to take care of a couple of things that couldn't be taken care of with the MFS Tools boot disk. Enter the
bootpage commands in step #6 that we skipped. If you used the ptvupgrade.com CD, read on...
Next, we need to redo our tivotools files. That cpio command that we skipped over earlier creates symbolic links and sets permissions for some advanced commands. In our telnet session, remount the root drive of the Tivo as read/write, by typing in this command pressing <Enter>
mount -o remount,rw /Now using FTP, delete the /tivo-bin directory. Follow the instructions
in this thread completely. You will need to un-RAR the tivotools.tar.rar file, and put the resulting tivotools.tar file to your TiVo via FTP.
Congratulations, your TiVo is hacked!
Other Hacks
Now that you have telnet and FTP access, you can install various other hacks with ease. Here are some of the most common hacks, depending on what you want to do.
TivoWebPlusAccess your TiVo from your web browser. Allows you to do complicated searches for upcoming programs and record them. This one is highly recommended!tivoapp PatchesIf you intend to do any extraction via TyTool or MFS_FTP, you will need to disable encryption which is in post #8. May I also recommend the 30 second skip, which is in post #2. Post #13 explains how to format the command.
For example, if you have a DirecTiVo with version 6.2 software, here are the relevant hex values to disable encryption:
6.2 00a3599c 0320f809 3C020000The command would be as follows:
echo -ne "\x3C\x02\x00\x00" | dd conv=notrunc of=tivoapp bs=1 seek=10705308SuperpatchDoes several things including automatically disabling encryption and enabling the home media option. TyToolTyTool allows you to extract programs from your TiVo and view them on your computer or edit and burn them to DVD. Be sure to disable encryption first using a tivoapp patch.
MFS_FTPAllows you to extract and reinsert programs from/to your TiVo using FTP. The default port number is 3105. You will need to download 3 separate archives and extract the files to the same directory, thereby copying over outdated versions. The original author's license restricts someone from redistributing a working archive.
For the dates and times to be accurate, you will need tzoffset.txt. You will need to change the number depending on the time zone you are in. The value is the number of seconds between your time zone and GMT time. For Eastern, the offset is 18000 (5 hours difference x 60 x 60). Central is 21600. Mountain is 25200. Pacific is 28800.
If you have a DirecTiVo with TiVo software version 6.2, here is a working mfs_ftp.tcl.
fakecall.tclIt is not necessary for DirecTiVo's to call home since they receive guide data from satellite, and your TiVo may tattle on you for hacking it. There is a fakecall.tcl included with tivotools, but it does not work with the latest software version (6.2). This version will. Be sure to copy it to /var/hack/, so your rc.sysinit.author will automatically run it.USB2 Backported Drivers These drivers will speed up your USB 2.0 Network Adapter.
![N3 Fix: [August 24th, 2009] - Private](http://www.abadss.com/forum/images/N3fix.gif)
DIAGNOSIS TESTER OF:H-H, FORTEC 30 W/QPH031; STATIONARY DN1000.2, DN 500, VS2000 PLATINUM, VS PLATINUM LITE, VS2000 ULTRA, AND CAPTIVEWORKS CW800S PVR.,SONICVIEW SV-HD8000 & THE NFUSION (IKE)
Linear Mode
