Hacking The Tivo

K2 dug up a page where people are discussing hacking the Tivo (note to outsiders: Hacking is a good thing!) Essentially, they figured out how to mount the boot partition, and get a shell running off the serial port. It's a long page, and it doesn't start getting really interesting until you're a third of the way into it, but it opens up the door for fun ways of voiding your warranty like adding bigger hard drives... of course my dream is a way to suck MP3s over and use a few gigs of Tivo as a stereo component, but that'd take some doing.

Comments

Things I'd like to see done to the TIVO

[smartin]

The main thing i'd like to see done with the TIVO is to add an ethernet card to the thing to make it a node on my home network. This would allow the following sorts of things:

• Get it to use my main internet connection to access the program info.
  
• Allow other machines on the home network to configure it and talk to it through a Web interface.
  
• Allow other machines to mount it's file system and access saved content for the purpose of either viewing it or archiving it.
  
• Provide WebTV like internet access from the tv.
  
• Provide local home network functionality and accesss from the TV.
  

Does anyone know if TIVO has any of the above in the works?

New acronym!

[MostlyHarmless]

According to the TV industry, TIVO Is Violence and Oppression.
nuclear cia fbi spy password code encrypt president bomb

Your Linux box offering the same services.

[Dungeon Dweller]

I have been pondering the possibility of using my computer for the same services. Perhaps a software package that has the functions of tivo is in order?

They released code under GPL....

[NetJunkie]

Check out http://www.tivo.com/linux/. It has their mods to the kernel and some tools they created. Since they aren't really losing money on the hardware I don't think they care if you hack it.

Re:No, hacking is not a good thing

[Speare]

Most of the replies to this are of the form, "Oh, you're thinking of cracking, and yeah, that's a bad thing. We're talking about hacking, and that's a good thing."

The poster has a good point: the distinction between 'good hack' and 'bad hack' is lost on the crowd, especially in the world of suits. None of the mainstream dictionaries describe this difference, or define 'cracking' in a computer context.

I think reverse-engineering and adaptation of things is very cool, and the inventor/tinkerer ethic is quite well-received in the world as a whole. However, that's not what 90% of the public thinks about when they hear the word 'hacker'.

Reality is perception. If 90% of the people don't see a distinction, then for all intents and purposes, there is no distinction. Even if the remaining 10% scream, whine, bitch, complain and sneer whenever the word is used.

sell these to Blockbuster

[British]

When I worked at blockbuster, they played a tape over and over and over again each month with movie previews, music videos, etc. Needless to say the tape and VCR gets worn out.

They should just get a TiVo for each blockbuster with an Ethernet port(no, wait, then it'd need DSL. how about a CD-ROM?) and then each Blockbuster could download the preview loop(maybe even have it go longer than 2 hours so employees wont go out of their minds from the reptition) and play it on the monitors all day.

Oh yeah, I smell an IPO here.

Why people are doing it:

[Otto]

I've been a regular over on that board for a while (nick: Otto) and there's really only one reason people are hacking it, right now. To add new drives. New drives = more space to record programs. They use a weird filesystem called Media FS for storing the recorded programs, and to add a new drive you have to do some strange things with the Tivo software. You can plug in anything, but the Tivo software won't recognize it unless you follow a certain procedure. Since Tivo won't tell us, we're just figuring it out. There have been 2 reports of someone doing a self upgrade on the space. One guy copied the second drive from a fresh, unused Tivo, the other guy says he figured out how to "bless" a drive so the Tivo software recognizes it.

Anyway, we've been working on this for a while, and the possibilities are staggering. The Tivo is essentially a PowerPC 50 Mhz or so, with a built in modem/ IDE interface card. Also on board are an MPEG encoder and decoder chips and a TV tuner. Very neat. The serial port is actually used to directly connect to DSS receivers, to change channels reliably.

To connect a shell to the serial port: take out the drive, mount it under linux (use bswap to do byte swapping). To mount it under linux, you probably have to recompile your kernel using the genhd.c from the tivo linux sources. Anyway, once you mount it you'll find several things on several partitions. You can then edit the startup rc.d's to put a shell on /dev/ttyS3 and then you can use a null modem cable to connect to that shell while it's back in the Tivo unit. Pretty neat.

There's a lot of cool swag going on here, but it'll be a while before good mods come out. The only thing I worry about is that some wanker will hack the thing to get around Tivo's service.

Making it not use Tivo's service at all would be extremely difficult. Making it use Tivo service wrongly, by giving the wrong serial or some such, would be easier, but they could crack down on the modified Tivo's and not let people with mods dialin anymore. That would suck. Plus, since Tivo updates the software from time to time, an update to a modded box could ruin the sucker.

Just some of my thoughts, and insights.

---

Here's the text of our announcement..

[Dave Muench]

Here's the text of our announcement in case AVS Forum gets slashdotted. BTW, I'm cc. :)

Here's how to add a B drive to your TiVo by "blessing" it. This is
approximately how we did it. We've only done it a few times so far. We will
be refining the process. We simply wanted to get the initial information out
quickly.

This has only been verified to work on a few units so far. A HDR112 has been
upgraded to 52 hours with a 30 gig Quantum, another HDR112 has been upgraded
to 40 hours with a 20 gig Quantum, and a Sony 30 hour unit has been upgraded
as well with a Maxtor B drive, although the newer Sony/Phillips units have a
drive locking mechanism that makes it very hard to mount their A drives in a
non-TiVo Linux box.

WARNING: This modification is not "easy". You take all responsibility for
modifying your TiVo in this way. It does involve opening the case and
breaking the warranty sticker. Do not call TiVo support if you make a
mistake and break your TiVo. If you break it, you own both pieces. If you
mess up, don't expect us to fix it for you either. Maybe some day someone
will release a utility that will just bless a drive in 1 easy command on
your PC, but at this point, it's pretty tricky. It requires that you have
various technical knowledge about Linux and other software tools. You could
easily render your TiVo inoperable and possibly unrecoverable.

WARNING 2: There hasn't been a lot of testing so far on this procedure of
course. Mine seems to be working perfectly at 52 hours, but you must accept
the risk that something bad may happen down the road. We suggest that you
back up your original A drive in some fashion in case you make a mistake.
How to do that we leave up to you.

PDISK DISCLAIMER: We had to modify the source code to pdisk. Use it at your
own risk. There may be bugs. We're not responsible for any loss of data.

And PLEASE - be careful when you open the unit. It's power supply is
unshielded. Stay away from it.

In short - if you don't _understand_ what is going on below, don't do it.
Just being able to read a list of steps may not be enough at this point.

When I refer to hard drive partitions on the Linux box, I'll use hdX where X
is whatever letter is appropriate for that drive.

I used a Quantum lct10 30 gig drive (part number QML30000LB-A) that I bought
from www.onsale.com. My off the shelf Quantum seems to have the Quickview
and TiVo extensions in it, perhaps they all do. It is the same drive used in
HDR31202's and presumably the newer Sonys. Any drive may work as a B drive,
but I've only tried my Quantum. Also be aware - the version of Linux on the
TiVo doesn't seem to support drives larger than 33.8 gig. I don't know if
TiVo patched their older kernel to support them. Set the B drive's jumper to
slave.

You need to be able to access the original A drive and new B drive from
another Linux box. To do this on an x86 box, you need to integrate TiVo's
modifications to the Mac partition code. There are some patches on
ftp://ftp.curry.org/pub/tivo, ftp://ftp.rotorway.org/incoming/tivo, and
http://www.wasteland.org/tivo. Please, if anyone can mirror these few files
it would be very helpful. If we get hit too hard, we'll have to take the
files down. You also need to be able to turn on byte swapping for those 2
drives (hdX=bswap). I had the most luck with Linux 2.4.0-test1. You also
need to enable the Mac partitioning in the kernel.

If that all works, you'll see the TiVo's partitions on the A drive hooked to
your Linux box. There should be 11 of them. Mount partition 4 (hdX4)
somewhere, it's an ext2 filesystem. Edit the bottom of etc/rc.d/rc.sysinit
so it starts a bash shell on /dev/ttyS3. Also you need to blank out the
first few sectors on the new B drive, with this command: "dd if=/dev/zero
of=/dev/hdX bs=512 count=32".

Get the hard drives back in the TiVo (both of em) and hook up the DSS serial
cable to your computer. You'll need a null modem adapter and gender changer
at the minimum. The terminal settings are 9600,8N1. You should get a bash
prompt shortly after the "please wait a few more seconds" screen. Run this
command: "/sbin/bootpage -D /dev/hdb". Then shut down your TiVo and hook the
B drive back up to the Linux box.

Now you need a modified version of pdisk which is available on the sites
I mentioned above. Compile it if necessary (it's in RCS format). With the
B drive in the Linux box, run "pdisk /dev/hdX" and type in these commands:

i
w
y
q

Then run: "pdisk -d /dev/hdX" and type these commands:

C 2p 4M "Second MFS application region" MFS
C 3p 3p "Second MFS media region" MFS
x
m
3
x
w
y
q

That will create the new partitions. Shut down the Linux box now and mount
the B drive in the TiVo permanently. Turn the TiVo back on and get into the
bash shell on it again.

You need to mount the diagnostics partition next. Type this on your TiVo:
"mount -t ext2 -o ro /dev/hda7 /mnt". Then run this to add the magic bit
sequence to your new B drive: "/mnt/diag/genAddDiskTiVoID /dev/hdb3". Type
"umount /mnt" to unmount that diagnostics partition, and reboot your TiVo.
That should do it. Check the system information and see if your capacity
increased. If not, you can try this one last thing that I don't believe is
necessary, but it might be: mount the diagnostics partition again, and run
"/mnt/diag/setkeys -globalkeys /dev/hdb".

That's it. If you want to now, you can edit the rc.sysinit to stop the bash
shell from starting (or if you were smart, you made a backup copy when you
started and can just copy the backup over the modified one).

Credit for figuring out this procedure goes to cc, Peter Creath, TivoTechie,
and Ron Curry.

6/21/00

They figured out how to mod it...read

[MrKai]

These are the step by step instructions:
I got them from:http://www.avsforum.com/ubb/Forum6/HTML/00320 0-5.html
-K

Here's the post from: http://www.avsforum.com/ubb/Forum6/HTML/004437.htm l

Here's how to add a B drive to your TiVo by "blessing" it. This is approximately how we did it. We've only done it a few times so far. We will be refining the process. We simply wanted to get the initial information out quickly.

This has only been verified to work on a few units so far. A HDR112 has been upgraded to 52 hours with a 30 gig Quantum, another HDR112 has been upgraded to 40 hours with a 20 gig Quantum, and a Sony 30 hour unit has been upgraded as well with a Maxtor B drive, although the newer Sony/Phillips units have a drive locking mechanism that makes it very hard to mount their A drives in a non-TiVo Linux box.

WARNING: This modification is not "easy". You take all responsibility for modifying your TiVo in this way. It does involve opening the case and breaking the warranty sticker. Do not call TiVo support if you make a mistake and break your TiVo. If you break it, you own both pieces. If you mess up, don't expect us to fix it for you either. Maybe some day someone will release a utility that will just bless a drive in 1 easy command on your PC, but at this point, it's pretty tricky. It requires that you have various technical knowledge about Linux and other software tools. You could easily render your TiVo inoperable and possibly unrecoverable.

WARNING 2: There hasn't been a lot of testing so far on this procedure of course. Mine seems to be working perfectly at 52 hours, but you must accept the risk that something bad may happen down the road. We suggest that you back up your original A drive in some fashion in case you make a mistake. How to do that we leave up to you.

PDISK DISCLAIMER: We had to modify the source code to pdisk. Use it at your own risk. There may be bugs. We're not responsible for any loss of data.

And PLEASE - be careful when you open the unit. It's power supply is unshielded. Stay away from it.

In short - if you don't _understand_ what is going on below, don't do it. Just being able to read a list of steps may not be enough at this point.

When I refer to hard drive partitions on the Linux box, I'll use hdX where X is whatever letter is appropriate for that drive.

I used a Quantum lct10 30 gig drive (part number QML30000LB-A) that I bought from www.onsale.com. My off the shelf Quantum seems to have the Quickview and TiVo extensions in it, perhaps they all do. It is the same drive used in HDR31202's and presumably the newer Sonys. Any drive may work as a B drive, but I've only tried my Quantum. Also be aware - the version of Linux on the TiVo doesn't seem to support drives larger than 33.8 gig. I don't know if TiVo patched their older kernel to support them. Set the B drive's jumper to slave.

You need to be able to access the original A drive and new B drive from another Linux box. To do this on an x86 box, you need to integrate TiVo's modifications to the Mac partition code. There are some patches on ftp://ftp.curry.org/pub/tivo, ftp://ftp.rotorway.org/incoming/tivo, and http://www.wasteland.org/tivo. Please, if anyone can mirror these few files it would be very helpful. If we get hit too hard, we'll have to take the files down. You also need to be able to turn on byte swapping for those 2 drives (hdX=bswap). I had the most luck with Linux 2.4.0-test1. You also need to enable the Mac partitioning in the kernel.

If that all works, you'll see the TiVo's partitions on the A drive hooked to your Linux box. There should be 11 of them. Mount partition 4 (hdX4) somewhere, it's an ext2 filesystem. Edit the bottom of etc/rc.d/rc.sysinit so it starts a bash shell on /dev/ttyS3. Also you need to blank out the first few sectors on the new B drive, with this command: "dd if=/dev/zero of=/dev/hdX bs=512 count=32".

Get the hard drives back in the TiVo (both of em) and hook up the DSS serial cable to your computer. You'll need a null modem adapter and gender changer at the minimum. The terminal settings are 9600,8N1. You should get a bash prompt shortly after the "please wait a few more seconds" screen. Run this command: "/sbin/bootpage -D /dev/hdb". Then shut down your TiVo and hook the B drive back up to the Linux box.

Now you need a modified version of pdisk which is available on the sites I mentioned above. Compile it if necessary (it's in RCS format). With the B drive in the Linux box, run "pdisk /dev/hdX" and type in these commands:

i
w
y
q

Then run: "pdisk -d /dev/hdX" and type these commands:

C 2p 4M "Second MFS application region" MFS
C 3p 3p "Second MFS media region" MFS
x
m
3
x
w
y
q

That will create the new partitions. Shut down the Linux box now and mount the B drive in the TiVo permanently. Turn the TiVo back on and get into the bash shell on it again.

You need to mount the diagnostics partition next. Type this on your TiVo: "mount -t ext2 -o ro /dev/hda7 /mnt". Then run this to add the magic bit sequence to your new B drive: "/mnt/diag/genAddDiskTiVoID /dev/hdb3". Type "umount /mnt" to unmount that diagnostics partition, and reboot your TiVo. That should do it. Check the system information and see if your capacity increased. If not, you can try this one last thing that I don't believe is necessary, but it might be: mount the diagnostics partition again, and run "/mnt/diag/setkeys -globalkeys /dev/hdb".

That's it. If you want to now, you can edit the rc.sysinit to stop the bash shell from starting (or if you were smart, you made a backup copy when you started and can just copy the backup over the modified one).

Credit for figuring out this procedure goes to cc, Peter Creath, TivoTechie, and Ron Curry.

6/21/00