Steve Jenkins' TiVo Network Hack How-To Guide

TiVo Network Hack How-To Guide

Boot CD Version

A step-by-step guide for first-time TiVo Network Hackers

 

By Steve Jenkins (a.k.a. TiVo sTeVe-o) - http://tivo.stevejenkins.com/

 

For use with Series 1 Standalone TiVo or DirectTiVo units and a PC with a bootable CD-ROM drive. Click here for the Boot Floppy Version.

 

Version 6.0, Last updated: April 11, 2005

 

If you find this guide helpful, please consider donating!

i. Introduction.. 2

ii. Location of this Document 2

iii. Before you Get Started.. 3

iv. Usage Notes. 4

v. A Word About Security. 4

1      Installing a Network Adapter in your TiVo.. 5

1.1       Opening your TiVo. 5

1.2       Creating an access hole for your network cable. 5

1.3       Connecting the network adapter 5

2      Gaining Telnet Access to your TiVo.. 5

2.1       Removing your A drive. 5

2.2       Making a backup copy of your A drive. 5

2.3       Creating the necessary Boot CD.. 6

2.4       Installing your TiVo’s A drive in your PC.. 6

2.4.1       Using the correct jumper setting and IDE channel 6

2.4.2       Disconnecting your PC’s current IDE channel 2 MASTER.. 6

2.4.3       Connecting your PC’s CD-ROM drive to IDE channel 1 SLAVE (/dev/hdb) 6

2.4.4       Connecting your TiVo’s A drive as the IDE channel 2 MASTER (/dev/hdc) 7

2.5       Booting your PC with the Linux Boot CD.. 7

2.5.1       Unlocking your TiVo’s A drive. 7

2.6       Logging in to Linux. 7

2.7       Flashing your DirecTiVo’s PROM (DirecTiVo users only) 8

2.8       Mounting your TiVo’s drive partitions. 8

2.8.1       Active vs. Inactive Partition. 9

2.8.2       If You Seem to be Missing a Partition. 9

2.8.3       Creating mount points. 9

2.8.4       Mounting the partitions. 9

2.9       Mounting Errors and Warnings. 10

2.9.1       EXT2-fs Warnings. 10

2.9.2       fatfs amd VFS Errors. 10

2.10    Creating your hack directory on partition 9. 11

2.11    Copying files into your hack directory. 11

2.12    Creating rc.sysinit.author on partitions 4 and 7. 12

2.13    Disabling initrd with kill_initrd (DirecTiVo users only) 14

2.14    Unmounting all partitions and exiting Linux. 14

2.15    Re-installing your TiVo’s A drive in your TiVo. 14

2.16    Booting your TiVo and connecting via Telnet 15

3      Configuring your TiVo to Make its Daily Call via the Network Adapter. 15

4      Installing Binaries on your TiVo that are Useful for Further Hacking.. 16

4.1       Installing the joe editor 16

4.2       Installing the tivo-bin binaries. 17

4.3       Installing tivoftpd – the TiVo FTP server 17

4.4       Using http_get to download files to your TiVo. 18

4.5       Installing TiVoWeb. 19

5      Starting Programs Automatically When Your TiVo Boots. 19

6      Including your Hack Binaries in your PATH for Easy Access. 22

6.1       Verify your current PATH.. 22

6.2       Creating your .profile file. 22

7      Automating READ/WRITE and READ ONLY switching in the file system... 23

7.1       Understanding different levels of remount automation. 24

7.2       Writing the automation scripts. 24

7.3       Creating aliases in your .profile file. 25

7.4       Creating a .bash_logout file. 26

7.5       Testing your automation settings. 26

8      Editing your .profile file. 27

8.1       Editing your PATH.. 27

8.2       Editing your Prompt 28

8.3       Adding More Aliases. 28

9      Setting up a static IP address. 29

9.1       Finding the info you’ll need. 29

9.2       Editing your rc.net file. 30

10        Mark your TiVo as Hacked! 31

11        Acknowledgements. 32

 

i. Introduction

The purpose of this document is to explain the step-by-step details of some initial TiVo network and shell hacks for beginners. “Network hacks” and “shell hacks” refer to procedures that allow you to access your TiVo via Ethernet, make daily calls via the Internet, access a shell prompt on your TiVo, and run a variety of programs on your TiVo. “Recording time hacks” refer to procedures that allow you to increase the available recording time on your TiVo by installing additional and/or larger hard drives in your unit. Since recording time hacks are well documented in other FAQs, this document will only deal with beginning network and shell hacks.

 

This document will walk a beginning TiVo hacker through the steps for the following procedures:

 

  1. Installing a network adapter in your TiVo
  2. Gaining telnet access to your TiVo
  3. Configuring your TiVo to make its Daily Call via the network adapter
  4. Installing binaries on your TiVo that are useful for further hacking (such as joe, tivo-bin, tivoftpd, and TiVoWeb)
  5. Starting programs automatically when your TiVo boots
  6. Including your hack binaries in your PATH for easy access
  7. Automating READ/WRITE and READ ONLY switching in the file system

ii. Location of this Document

The current version of this document can always be found online at:

 

http://tivo.stevejenkins.com/

 

Please feel free to link to that URL from your TiVo-related page.

iii. Before you Get Started

Before you start hacking your TiVo, there are a few things you should verify before you get started. First, you should know that these instructions were originally developed and tested on a previously un-hacked Series 1 Sony SVR-2000 Standalone TiVo unit, running System Software version 3.0. If you have a system or configuration other than this one, some steps may be slightly different. However, I’ve heard reports of successful hacks using this guide by owners of a variety of different systems and configurations. These instructions will also work for Series 1 DirecTiVos (aka DTiVos), with a few additional steps which are highlighted with green text out throughout the guide.

 

I’ve also heard of some people using these instructions on Series 2 TiVos with some modifications, but since I don’t have a Series 2 TiVo I can’t offer any assistance in that area. If you want to hack a Series 2 TiVo, I suggest visiting one if the sites in my “Special Thanks” section at the end of this guide.

 

Additionally, this guide assumes the following:

 

  • You have a Standalone TiVo or DirecTiVo unit with either a lifetime service or an account in good standing. I don’t support stealing TiVo service, and nothing in this document will help you do so.
  • You are willing to void your warranty. Opening your TiVo unit (which is necessary to install a network adapter and/or remove the disk drive for editing on your PC) is not officially supported by TiVo, Inc., and will thereby void any remaining warranty on your unit.
  • You have access to a PC with a bootable IDE CD-ROM drive and an IDE controller, which will be used to mount the TiVo. If you don’t have access to a CD-ROM drive and are hacking a Series 1 standalone TiVo (not a DirecTiVo), then you can use the Boot Floppy version of this guide.
  • You have sufficient computer experience to feel comfortable opening a computer case, installing hard drives, making settings changes, understanding jumper settings, etc.
  • Your system was not previously hacked
  • You have purchased a special Ethernet adapter that is designed to work with your TiVo, such as the TiVoNET or TurboNET card. I suggest the TurboNET card from http://www.9thtee.com/ A standard Ethernet adapter WILL NOT work.
  • Your TiVo unit is running version 3.0 of the TiVo system software. Plug-and-play support for the most popular TiVo network adapters is built in to the 3.0 system software, and a number of steps required to configure a network adapter in your TiVo are thereby avoided. However, it is still possible to use these instructions with a previous software version, but you must first install and configure your network adapter using instructions found on the site where you purchased the adapter, and then skipping ahead to the second section of this How-To.
  • You have a DCHP server running on your internal network (Windows 2000 Server, Linksys DSL/Cable Router with DHCP, etc.) that can assign an IP address to your networked TiVo.
  • You assume all risk associated with following these instructions and otherwise hacking your TiVo unit. Your system may operate unexpectedly or stop working all together. You proceed at your own risk.

iv. Usage Notes

Throughout this document, there are a number of lines of text, code, or commands that must be typed on your TiVo and your PC. These are shown in bold Courier font, like this. Individual keystrokes to be entered are also shown in Courier font, but inside brackets and without the bold formatting, [like this]. For example, if you were supposed to type the words “Hello World!” and then press the ENTER key on your keyboard, the instructions to do so would look like this:

Hello World! [ENTER]

Lines of code are shown as they would appear in the text editor, like this:

 

This is line 1 of the code

This is line 2 of the code

This is line 3 of the code

 

In some cases, you will be required to hold down one key on your keyboard while you press another, and those keys will be shown in this document with a plus sign between then, such as CTRL+K. This example means that you should hold down the CTRL key while you press the K key.

 

Some of the instructions in this guide are only applicable to DirecTiVo units (DirecTV satellite receivers and TiVos combo units). Additional instructions that must be completed for DirecTiVo users will be marked in green. These instructions should be ignored by standalone TiVo users, or they may cause damage to your TiVo. Make sure you know if you have a standalone TiVo or a DirecTiVo unit before proceeding.

 

v. A Word About Security

These instructions will essentially turn your TiVo into a device that is accessible via a TCP/IP network connection. That gives you a lot of potential power to control your TiVo, but it also creates potential security risks. If you follow all the instructions in this document, you will be able to access your TiVo via a telnet client, an FTP client, and a Web browser. But if you don’t take the necessary steps to secure the network to which your TiVo is connected, unwanted visitors may also be able to access your TiVo via telnet, FTP, or Web. That would be bad…

 

These instructions require that your TiVo be able to “hear” a DHCP broadcast on your network to assign itself an IP address and become a network-enabled device. It is not advisable to connect your TiVo directly to your cable or dsl modem to connect directly to the Internet, but to connect your TiVo to one of the popular Cable/DSL routers that have built-in DHCP servers and NAT translation (such as a Linksys). Behind one of these devices, your TiVo should be plenty secure. Such devices act as a firewall to protect the devices inside your network (such as your TiVo is about to be) from unwanted access from the outside world. If, at a later time, you decide to start tinkering with port forwarding on your firewall to the IP address that is assigned to your TiVo, be aware that by default, your TiVo is set up with absolutely no protection from outside access whatsoever, and take steps to protect yourself.

 

Don’t let this warning scare you into reconsidering your decision to hack your TiVo. The vast majority of users who are reading these directions don’t have anything to worry about. Plug it in, turn it on, and hack away. Just be sure to keep security in mind if you decide to take your hacking to a new level on your own later on.

1         Installing a Network Adapter in your TiVo

1.1      Opening your TiVo

Power down your TiVo by pressing the POWER button (if available) and unplugging the power cord. MAKE SURE THE POWER CORD IS REMOVED BEFORE YOU PROCEED! Using a Torx #10 screwdriver, remove the three screws on the back of the unit and slide the cover off by pushing it away from the front of the unit. Resist the urge to pry if the cover is hard to remove. If you have trouble, place your TiVo on the ground and use a gentle kick on the top side edges to slide the cover toward the rear of the unit. Congratulations! You just voided your warranty! Remember that even though the power cord is unplugged, the power supply can store residual electricity for a long time. DO NOT TOUCH THE POWER SUPPLY, as it can provide a dangerous electrical shock and/or damage your TiVo’s components.

1.2      Creating an access hole for your network cable

Unless you are using a wireless Ethernet adapter, you will need a hole for your network cable to come out of your TiVo. Since you’ve already voided your warranty, you shouldn’t have any problems taking a hacksaw to your unit’s cover. Now you’re REALLY going to “hack” your TiVo (sorry for the lame joke, I couldn’t resist)! Using your hacksaw, remove the tab on your unit’s cover that covers up the hole immediately to the LEFT of your TiVo’s fan as you look at it from the rear of the unit. Do not remove the tab that covers the hole on the right, as this tab has a screw hole used to secure the cover. After removing the tab, use a metal file to remove any metal shards and sharp edges. Any dim hope of a warranty should now be fully removed from your mind.

 

For DirecTiVo users: Your unit doesn’t have a handy tab on the back to remove like the standalone units.  However, using a Dremel tool, tin snips, or another cutting tool of your choice, you can clip off a couple of the "waffle-iron" grids on the left hand side of your unit to make a hole for your cable.

1.3      Connecting the network adapter

As you look at your TiVo from overhead, with the front of the unit facing away from you, you should see the spot on your system board where your network adapter will slide into place. Carefully install your network adapter by sliding it onto your system board. Make sure it is firmly in place before continuing. Plug one end of your network cable into the adapter and push the other end out the back of your unit through the hole to the left of the fan. Be sure to avoid your TiVo’s power supply. A standard RJ-45 jack will just barely fit through the hole.

2         Gaining Telnet Access to your TiVo

2.1      Removing your A drive

When the cover removed from your TiVo, locate your unit’s A drive. If you only have one drive inside your TiVo, then it should be pretty easy to find! If you have a 2 drives in your TiVo unit, they may be labeled with colored stickers, and the A drive is usually the one on the end of the IDE cable, with the B drive connected in the middle. Additionally, the A drive is the one with its jumper settings set to MASTER, and the B drive will be set to SLAVE or have no jumpers at all. Using the same Torx #10 screwdriver as before, remove the two screws that secure your TiVo’s A drive. Remove the IDE cable and power cable from the drive, and remove the drive from your TiVo.

2.2      Making a backup copy of your A drive

Some of the changes you’re about to make to your TiVo’s A drive can, if done incorrectly, affect your system’s ability to function properly. It’s also possible that future updates to TiVo’s system software may react badly to the changes you make while hacking, turning your beloved TiVo into a large paperweight. That’s why it’s a smart idea to create a backup of your A drive before proceeding any further. In fact, many TiVo hackers choose to use their backup drive as their A drive, and store the original A drive in a safe place - such as a  fire-proof safe, a safe-deposit box, or under your bed. The easiest method of making a backup of your A drive is to use Tiger’s Mfs Tools and following the instructions at http://www.newreleasesvideo.com/hinsdale-how-to/. While this step is technically optional, no self-respecting TiVo hacker is ever without a backup drive.

2.3      Creating the necessary Boot CD

In order to access your TiVo drive after it is connected to your PC, you will need to create a special bootable Linux CD-ROM. If you don’t have the ability to burn a CD-ROM or if your PC’s BIOS won’t support booting from CD-ROM, then you will need to follow the instructions in the Boot Floppy version of this guide.

 

DirecTiVo users: you must use a Boot CD, because the files requires to hack your unit will not fit on floppies.

 

To make the Boot CD, visit http://tivo.stevejenkins.com/downloads/ and download the jenkins.iso file. Using a CD-ROM authoring program, burn the ISO image to a blank CD-R disc. For Windows users, I recommend using Nero, a popular shareware burning tool.

 

This Boot CD contains all the files necessary to complete the hacks outlined in this guide for Standalone and DirecTiVo units.

2.4      Installing your TiVo’s A drive in your PC

2.4.1       Using the correct jumper setting and IDE channel

The jumpers on your TiVo’s A drive are currently set to MASTER (as opposed to SLAVE), so to make things easy throughout this entire process, it’s best to keep it set as MASTER when you install it in your PC. It is possible to complete this procedure with the drive set up as a SLAVE on IDE channel 1 or 2, but you’ll have to change the drive’s jumper settings, change some of the syntax of the commands used to mount the drive, and then change the jumper setting back to MASTER before you re-install it in your TiVo. Therefore, to make things as simple as possible and avoid dangerous mistakes, just keep the drive set as MASTER and install it on IDE channel 2.

2.4.2       Disconnecting your PC’s current IDE channel 2 MASTER

Open your PC’s case and unplug the IDE cable and power cable from whatever device is in installed as the IDE channel 2 MASTER. You can find out which IDE channel a cable is connected to by looking at the markings on your motherboard next to the IDE connectors. The MASTER device for that channel will be the device that is connected to the first connector as you move away from where the IDE cable connects to the motherboard. There’s a good chance that your IDE channel 2 MASTER will be your PC’s main hard drive. Even if it isn’t, it’s a good idea to unplug the IDE and power cable from your PC’s main hard drive to prevent any accidental data loss on your PC.

2.4.3       Connecting your PC’s CD-ROM drive to IDE channel 1 SLAVE (/dev/hdb)

Again, in order to keep the instructions in this guide consistent, these instructions will refer to any steps involving the CD-ROM drive as if it were installed as the IDE channel 1 SLAVE. If you don’t want to change your CD-ROM to this setting, you will need to modify later steps in this guide to properly access your CD-ROM drive on the appropriate channel and MASTER/SLAVE setting.

 

In Linux terms (and for future reference in this guide), the IDE channel 1 SLAVE is referred to as /dev/hdb (which stands for the device installed as hard drive B).

2.4.4       Connecting your TiVo’s A drive as the IDE channel 2 MASTER (/dev/hdc)

Connect the IDE channel 2 MASTER connector and a power cable to your TiVo’s A drive. If your connectors are long enough, you can place the drive (still in its mounting bracket) on top of or near your PC with the case open. If you’ve got the IDE connector installed incorrectly, you’ll find out soon enough in a subsequent step. If you discover this to be the case, simply power down your PC, swap the IDE connector, and start over from this step.

 

In Linux terms (and for future reference in this guide), the IDE channel 2 MASTER is referred to as /dev/hdc (which stands for the device installed as hard drive C).

2.5      Booting your PC with the Linux Boot CD

Insert your Linux Boot CD into your PC and power it up. If all goes well, your system will boot from the CD-ROM. At one point, you will see a welcome screen with a boot: prompt. Just press ENTER to continue booting into Linux with the default settings. Keep an eye on all the messages on the screen as they fly by. Near the end of the boot sequence, Linux will attempt to connect to all your IDE devices. It will name your floppy drive something like FD0 and it will name the TiVo A drive you installed as the IDE Channel 2 Master something like HDC and your CD-ROM drive something like HDB. You can hold down the SHIFT key and use the PAGE UP and PAGE DOWN keys to review these screens as they scroll by.

2.5.1       Unlocking your TiVo’s A drive

The Boot Floppy version of this guide addresses how to unlock a “locked” Quantum brand TiVo A drive. However, this is not an issue for Boot CD users, since the CD automatically unlocks any locked drives. For more information about locked drives, check out section 2.15 of the TiVo Hack FAQ at http://www.tivofaq.com/hack/faq.html.

2.6      Logging in to Linux

Once Linux finishes booting, you’ll see a TBD login: prompt. Simply type:

root [ENTER]

to log in. You do not need a password.

 

If Linux was able to automatically “mount” (or make available) your CD-ROM drive during the boot sequence, you will get a message after you log in that says something like:

mount: block device /dev/hdb is write-protected, mounting as read-only

This simply means that it recognized that the CD-ROM was a read-only disk, so it mounted it as such.

 

You should now have a shell prompt with a “/#” where you can type commands. Try:

ls [ENTER]

to see a listing of the current directory. You’re almost ready to start making the necessary changes to your TiVo’s A drive!

2.7      Flashing your DirecTiVo’s PROM (DirecTiVo users only)

Before you can make all the necessary changes to hack your DirecTiVo, you need to flash the PROM (Programmable Read Only Memory) on your system’s motherboard. Don’t worry – it’s a lot less scary than it sounds. Of course, you’re already way past voiding your warranty at this point, but proceed cautiously and at your own risk.

 

The PROM on the DirecTiVo units have a self-protecting verification system designed to fight the kind of hacks you’re currently performing. In order to defeat this system, you will need to run a small script from the Boot CD, re-install your DirecTiVo’s A drive in your unit, boot your DirecTiVo, re-install the DirecTiVo’s A drive in your PC, and continue your hacks.

 

With your DirecTiVo’s A drive in your PC, start the PROM flash script by typing the following:

/tivoflash/install [ENTER]

You’ll then be asked to type in the device name of your DirecTiVo’s A drive. If you installed as the IDE Channel 2 MASTER as recommended, type in:

hdc [ENTER]

If you installed it in a different configuration, then you apparently think you’re experienced enough to figure it out, so go ahead and make the appropriate choice.

 

The script will then tell you that it’s going to overwrite the data in your inactive kernel and root partitions, it will also display what it has figured out about the partitions on your DirecTiVo’s A drive, and it will ask if you want to continue. If everything looks OK, type y for yes, and the script will spring into action. It will display a bunch of information on your screen as it checks, copies, mounts, flashes, unmounts, switches, etc.

 

If everything goes well, you’ll receive an “Upgrade Complete” message and some instructions about what to expect when you reboot your DirecTiVo.

 

Press CTRL+ALT+DEL to reboot your PC, then power down your PC’s when the BIOS screen appears.

 

Re-install your DirecTiVo’s A drive in your DirecTiVo unit, and fire it up. You’ll see the “Powering Up” message on your TV screen, and then your unit will reboot itself. This is normal. Wait a few moments until your unit successfully boots all the way.

 

Congratulations! Your DirecTiVo PROM is now successfully flashed, and you’re ready to continue your hacking.

 

Power down your DirecTiVo unit, re-install your A drive in your PC, boot from the Boot CD again, and continue on to the next step. Once your PROM is flashed, you shouldn’t ever have to repeat this step.

2.8      Mounting your TiVo’s drive partitions

The information on your TiVo’s A drive is stored in different sections, called partitions. A standard single or dual-drive TiVo contains 11 partitions. Three of these partitions (partitions 4, 7, and 9) are mountable by the Linux operating system, and so that’s where you will edit files and store programs to “hack” (or enhance the functionality of) your TiVo.

2.8.1       Active vs. Inactive Partition

Before you start mounting and editing files on your TiVo’s A drive, you should understand how TiVo treats partitions 4 and 7. These partitions both contain copies of what’s called the root image of your TiVo’s operating system, but only one of these partitions contains the active root image, and is therefore referred to as the active partition. The active partition contains the most current version of your TiVo’s system software and configuration files. The inactive partition contains a copy of the previous version of your TiVo’s system software and configuration files as a backup. Depending on which partition was active when you first plugged in your TiVo, how many system software updates you’ve received, and the alignment of the planets, either partition 4 or partition 7 will be your currently active partition, and the other one will be the inactive partition. You’ll find out which is which in your case in a following step.

 

When your TiVo downloads a new system software update (TiVo Inc. has been releasing updates about once or twice a year), your TiVo writes the updated software to the inactive partition. When your TiVo reboots for the first time following the update, it swaps the active and inactive partitions (from 4 to 7 or from 7 to 4), thereby creating a backup of the previous version of the system software on what’s now the inactive partition, and running the current version on what’s now the active partition.

 

2.8.2       If You Seem to be Missing a Partition

If you performed a capacity upgrade to your TiVo’s A drive using MFSTools prior to following the steps in this guide, your TiVo will not contain a copy of the inactive partition because MFSTools does not back up the inactive partition by default. Don’t worry - your TiVo will automatically create an inactive partition the next time it updates its system software, and you can still use all the information in this guide without any problems. You’ll discover soon enough in the next step if your TiVo is missing its inactive partition, and what you need to do as you continue through this guide. If you upgraded your TiVo’s recording capacity by simply adding a B drive but did not alter your A drive in any way, then you will still have both partitions on your system.

2.8.3       Creating mount points

To gain access the necessary partitions they must be mounted. Start by creating some new directories that will serve as your mount points:

mkdir /mnt4 [ENTER]

mkdir /mnt7 [ENTER]

mkdir /mnt9 [ENTER]

2.8.4       Mounting the partitions

Now you’re ready to mount your A drive’s partitions by associating them with the other mount points you’ve created. Mount partitions 4, 7, and 9 with these commands:

mount /dev/hdc4 /mnt4 [ENTER]

mount /dev/hdc7 /mnt7 [ENTER]

mount /dev/hdc9 /mnt9 [ENTER]

To see all your newly mounted devices type:

df [ENTER]

You should see the following 5 devices on the following mount points

 

/dev/ram0 mounted on / – this is the RAM disk containing the operating system and assorted files mounted to the root directory.

 

/dev/hdb mounted on /var/log/mount – this is your IDE CD-ROM drive (SLAVE on IDE C, and the Boot CD mounted it on the /var/log/mount mount point by default

 

/dev/hdc4 mounted on /mnt4 – this is your TiVo A drive’s partition #4

 

/dev/hdc7 mounted on /mnt7 – this is your TiVo A drive’s partition #7

 

/dev/hdc9 mounted on /mnt9 – this is your TiVo A drive’s partition #9

 

As an FYI, you the “hd” in the device names refers to a “hard drive,” and the letter following the “hd” refers to the IDE channel 2 and device. The channel 1 MASTER would be “a,” and the channel 1 SLAVE would be “b.” The channel 2 MASTER that you mounted is “c,” and the channel 2 SLAVE would be “d.” As long as you set everything up as recommended, you don’t really need to know this. But it’s good to know for future reference.

2.9      Mounting Errors and Warnings

There are a couple of common errors and/or warnings that you may receive as you attempt to mount the partitions mentioned in the previous step. Both are addressed in this section.

2.9.1       EXT2-fs Warnings

There are some EXT-fs warning messages that you may receive a warning message in response to some or all of the mount commands that says. The three most common are:

EXT2-fs Warning: checktime reached

EXT2-fs Warning: mounting unchecked file system

EXT2-fs Warning: maximal count reached

These warnings can be ignored. They are generated by the Linux operating system when it successfully mounts unfamiliar or unchecked partitions. You can do a Google search on EXT2-fs warnings later if you’re curious as to exactly why they occur, but for now you should feel free to continue.

2.9.2       fatfs amd VFS Errors

While trying to mount partition 4 or 7, you may receive an error that looks like this:

 

fatfs: bogus cluster size

VFS: Can't find a valid MSDOS filesystem on dev 16:07.

fatfs: bogus cluster size

VFS: Can't find a valid MSDOS filesystem on dev 16:07.

mount: you must specify the filesystem type

 

This error occurs if you attempt to mount a partition that does not exist. If you performed a capacity upgrade to your TiVo’s A drive using MFSTools, which does not backup the inactive partition, then you will receive this error because you are missing either partition 4 or 7.

 

If you received this error while trying to mount partition 4, then you do not have a partition 4 and your active partition is 7. Conversely, if you received this error while trying to mount partition 7, then your active partition is partition 4, and partition 7 is missing. Don’t worry – you can still follow the steps in this guide. Continue on with only the current partitions mounted and when the guide instructs you to make changes to both the active and inactive partitions, make them only to the active one.

2.10Creating your hack directory on partition 9

In order to keep all the files required for hacking your TiVo in a central location, you should create a new directory on partition 9 to store them. Partition 9 is a special for a number of reasons, including the fact that it usually survives a system software update by TiVo. When it’s mounted in the TiVo unit, partition 9 is seen as the /var directory. But in your PC, you’ve set it up as /mnt9 for easy reference while hacking.

 

Create a new directory for your hack files with the following commands:

cd /mnt9 [ENTER]

mkdir hack [ENTER]

Now check to make sure that your hack directory was successfully created with:

ls -l [ENTER]

You should see something that looks like this:

 

total 25

drwxr-xr-x   2 0        0            1024 Jan  1  1970 bin

drwxr-xr-x   2 0        0            1024 Jan  1  1970 dev

drwxr-xr-x   2 0        0            1024 Jan  1  1970 etc

drwxr-xr-x   5 0        0            1024 Jun 28 13:01 hack

drwxr-xr-x   2 0        0            1024 Jun 28 19:29 log

drwxr-xr-x   2 0        0           12288 Jan  1  1970 lost+found

-rw-r--r--   1 0        0              75 Jun 28 18:46 mtab

drwxr-xr-x   2 0        0            1024 Jun 28 19:29 packages

drwxr-xr-x   2 0        0            1024 Jun 28 18:52 persist

drwxr-xr-x   2 0        0            1024 Jan  1  1970 run

drwxr-xr-x   3 0        0            1024 Jun 27 17:56 state

-rw-r--r--   1 0        0               0 Mar  3 00:50 teletextin

-rw-r--r--   1 0        0               0 Jun 28 18:53 timestamp

drwxr-xr-x   2 0        0            2048 Jun 28 19:56 tmp

drwxr-xr-x   2 0        0            1024 Jun  2 09:01 utils

 

Notice the directory called “hack” is the fourth line down. Now you’re ready to start copying files into your hack directory.

2.11Copying files into your hack directory

Access your mounted Boot CD by typing:

cd /var/log/mount [ENTER]

Type in:

ls [ENTER]

You’ll see a number of files and directories listed. It’s interesting to note that this is the root directory of your Boot CD, even though it appears to be three levels deep (/var/log/mount) because it’s mounted as such. You should see one directory called jenkins, which contains some of the files you will need to complete some of the following hacks.

 

Change into the jenkins directory:

cd jenkins [ENTER]

Then display the contents of that directory with:

ls [ENTER]

You should see the following three files:

 

joe.tgz

tivobin.tgz

tivoftpd

 

Copy all these files to your newly created hack directory on your TiVo drive by typing:

 

cp * /mnt9/hack [ENTER]

 

Then verify that the files copied correctly by changing to the hack directory and listing the contents:

 

cd /mnt9/hack [ENTER]

ls [ENTER]

 

You should now see all three files successfully copied in your hack directory!

2.12Creating rc.sysinit.author on partitions 4 and 7

Whenver your TiVo boots, it looks inside a startup file called rc.sysinit and configures itself and runs programs according to the instructions it finds there (much like the AUTOEXEC.BAT and CONFIG.SYS files work in DOS systems). This file exists on both the active and inactive partition, so if you ever make changes to this file, you need to do so on both partitions 4 AND 7 (unless you are missing one of these partitions as a result of a capacity upgrade – in which case you only need to make the changes on whichever of the two partitions exists on your system).

 

After following the instructions in the rc.sysinit file, your TiVo will look for a second file called rc.sysinit.author and, if it exists, will do whatever that says it should do. If you make a mistake while editing your rc.sysinit file, it can prevent your TiVo from booting. So it’s much safer to create an rc.sysinit.author file and make any startup changes to that file instead.

 

Start by creating a new rc.sysinit.author file on partition 4. Type these commands to change to the directory where the TiVo startup files are stored, then create your new file:

cd /mnt4/etc/rc.d [ENTER]

joe rc.sysinit.author [ENTER]

You should now see a blank rc.sysinit.author file opened for editing inside the joe editor.

 

At the top of the file, enter the following line:

#!/bin/bash

That tells the TiVo to “interpret” the current script with the bash shell. On the next line, type in the following, which tells TiVo to start the telnet service on port 23 when it boots:

tnlited 23 /bin/bash -login &

Press CTRL+K followed by the X key to save and exit the file.

 

Before your TiVo can run your rc.sysinit.author file, however, you need to change the permissions of the file so that it is executable. Do this by typing:

chmod 755 rc.sysinit.author [ENTER]

Now create the file on partition 7:

cd /mnt7/etc/rc.d [ENTER]

joe rc.sysinit.author [ENTER]

You should now see a blank rc.sysinit.author file opened for editing inside the joe editor. At the top of the file, enter the following line:

#!/bin/bash

That tells the TiVo to “interpret” the current script with the bash shell.

 

On the next line, type in the following, which tells TiVo to start the telnet service on port 23 when it boots:

tnlited 23 /bin/bash -login &

Press CTRL+K followed by the X key to save and exit the file.

 

Before your TiVo can run your rc.sysinit.author file, however, you need to change the permissions of the file so that it is executable. Do this by typing:

chmod 755 rc.sysinit.author [ENTER]

By default, the joe editor makes a backup of any file it edits if changes were made during the editing session, and saves these backups with tilde character (~) at the end of the filename. In the future, when you make changes to your rc.sysinit.author file, joe will create a backup file called rc.sysinit.author~. Any time you see a file you may have edited with a tilde on the end, it’s pretty safe to assume that it’s a backup version of the file created by joe.

2.13Disabling initrd with kill_initrd (DirecTiVo users only)

DirecTiVo users need to complete an additional step at this point to ensure that all the above changes you just made to your TiVo A drive won’t be removed by the initrd program on your DirecTiVo when it boots. You need to disable initrd (which is stored on your DirecTiVo’s A drive) by running the kill_initrd program from the Boot CD.

 

Change into the kill_initrd directory by typing:

cd /kill_initrd [ENTER]

Now you can check the status of initrd on your TiVo drive by typing the following:

./kill_initrd info [ENTER]

This will detect your TiVo hard drive and tell you whether initrd is currently enabled or disabled.

 

If you receive an error that says:

Error – No TiVo drive detected.

it means you probably deleted initrd from the drive using another utility at some previous time (such as is you used dd while expanding your DirecTiVo with a larger drive). Don’t worry – you don’t really need initrd, and since it’s completely gone it can’t remove your hacks – so you can safely skip the rest of this step.

 

It’s more likely, however that you will get a message that initrd is enabled, so you need to disable it by typing the following:

./kill_initrd disable [ENTER]

Once initrd is disabled, your hacks won’t mysteriously disappear when you re-install your A drive in your TiVo, and you’re ready to continue to the next step

2.14Unmounting all partitions and exiting Linux

Now that you’ve made the necessary changes to your TiVo’s A drive, you need to unmount the four partitions you previously mounted before exiting by typing:

cd / [ENTER]

umount /mnt4 /mnt7 /mnt9 [ENTER]

exit [ENTER]

This will unmount all your mount points, log you out of the Linux shell, and return you to the Linux login prompt. Power down your PC and wait a few seconds for the hard drive to spin down. Now you’re ready to put your A drive back in your TiVo!

2.15Re-installing your TiVo’s A drive in your TiVo

With your PC powered off, disconnect the IDE and power cables from your TiVo’s A drive and re-install the drive in your TiVo. Make sure the power and IDE cables are properly plugged in.

2.16Booting your TiVo and connecting via Telnet

Before putting the cover back on your TiVo, verify that it can boot properly. Attach the A/V out cables to your TV, then plug in the TiVo’s power cord. You should see the initial boot up screen with the TiVo logo, followed by the gray screen with “Almost there…” message, and then the TiVo startup animation. You should also see the light on your TiVo’s network adapter flashing periodically. You may need to press the POWER button on your remote to get the TiVo working.

 

Check your DHCP server to see what IP address was assigned to your TiVo. If you’re using a Linksys Router as a DHCP server, go to the router’s configuration page in your browser, select the DCHP or Local Network tab and press the DHCP Clients Table button. Your TiVo’s IP address will probably start with 192.168.1.

 

If you’re using the DCHP server built into a Windows NT/2000/2003 Server, you can check the “Address Leases” object in your Scope to discover the MAC address of your TiVo (it will probably have the letters “bad” in the MAC address), then use that MAC address to create a DCHP reservation so that your TiVo is always assigned the same IP address whenever it boots. If you want to assign a static IP to your TiVo, you’ll find instructions on how to do so later in this guide, and you’ll be able to make the necessary changes on the TiVo itself.

 

For the rest of this guide, we’ll assume that your DHCP server assigned an IP address of 192.168.1.102 to your TiVo, but you should replace in any of the following commands with whatever IP address your DHCP used instead.

 

Connect to your TiVo from Windows by pressing Start, run, then:

telnet 192.168.1.102 [ENTER]

Mac users: You should add the –K option to your telnet command to avoid local character echo when connected to your TiVo, like so:

telnet –K 192.168.1.102 [ENTER]

Replace the IP listed in the telnet command above with your TiVo’s IP address. You will not need to log in with a user name or password. You should get a shell prompt that looks like this:

bash-2.02#

Congratulations! You’ve successfully hacked a shell prompt on your TiVo!

3         Configuring your TiVo to Make its Daily Call via the Network Adapter

Now that you’ve successfully set up your network adapter, you can configure your TiVo to make its Daily Call via the network adapter, instead of dialing out via the modem.

 

This is done simply using your TiVo’s remote control.  Hit the TiVo button, then choose Messages & Setup. From that menu, choose Recorder & Phone Setup, Phone Connection, Phone Dialing Options, then Set Dial Prefix.

 

Using the buttons on your remote, enter the following as your dial prefix:

,#401

That’s PAUSE (to create the comma) then ENTER (to create the #) then the numbers 401. There should be no spaces between all the characters. Press SELECT when you’re done.

 

This prefix tells your TiVo to bypass the modem and make all outgoing calls via the network adapter. Test your settings by making a test call. It should only take a few moments for TiVo to complete the test call if you have a high-speed Internet connection.

 

DirecTiVo users: Choosing these settings allows you to make your daily TiVo call via the network adapter, but you should still keep a phone line connected to your unit if you make DirecTV Pay-Per-View purchases.

4         Installing Binaries on your TiVo that are Useful for Further Hacking

To get the most out of your hacked TiVo, you should install some additional programs that will allow you to take full advantage of your shell access. This section will step you through setting up a file editor called joe, a collection of binary utilities called tivo-bin, and the TiVo FTP server named tivoftpd so you can easily transfer files to your TiVo.

4.1      Installing the joe editor

If you haven’t already, telnet into your TiVo so that you’re at a shell prompt. Go to the hack directory you created while the drive was mounted in your PC by typing:

cd /var/hack [ENTER]

You will not be able to do an ls command here yet, since the ls command is not installed by default on your TiVo. Don’t worry, you will fix that in a minute.

 

Type the following to decompress and extract the files from the joe distribution:

gzip -d joe.tgz [ENTER]

cpio -idu -H tar < joe.tar [ENTER]

These two commands will unzip the compressed joe.tgz into joe.tar. A tar file (also referred to as a tarball) is a file that contains multiple files inside it. Now that you’ve extracted the files from the tarball, you need to set the file permissions for the main joe file (which was in the tarball) to executable by typing:

chmod 755 joe [ENTER]

Test your work by typing:

./joe testfile [ENTER]

You need to type the period and slash before the joe command because the current directory isn’t yet in your system path. Don’t worry, you’ll fix that in a minute as well.

 

If joe is installed properly, it should have opened a new file called testfile. Press CTRL+K followed by the X key to exit.

4.2      Installing the tivo-bin binaries

The tivo-bin binaries are a collection of common Linux commands that are not available by default in the TiVo operating system. Commands such as ls, tail, uptime, and touch are included in this distribution. If you’re not already in the /var/hack directory, type the following to get there:

cd /var/hack [ENTER]

Type the following to decompress and extract the files from the tivo-bin distribution:

gzip -d tivobin.tgz [ENTER]

cpio -idu -H tar < tivobin.tar [ENTER]

This will create a new directory under /var/hack called /var/hack/tivo-bin, and extract the contents of tbin.tar into that directory. Most TiVo hackers rename the /var/hack/tivo-bin directory to /var/hack/bin by typing the following:

mv tivo-bin /var/hack/bin [ENTER]

Now change into the /var/hack/bin directory by typing:

cd /var/hack/bin [ENTER]

You can type the following to make sure you’re in the /var/hack/bin directory:

pwd [ENTER]

That command will always display the current directory.

 

Next, you need to set the file permissions for all the files in this directory to executable by typing:

chmod 755 * [ENTER]

Test your work by typing:

./ls [ENTER]

Since the ls is stored in the current directory, it should display the contents of your /var/hack/bin directory. The commands in your /var/hack/bin directory will not work from any other directory yet since you have not yet included this directory in your path. You will do that in a subsequent step.

4.3      Installing tivoftpd – the TiVo FTP server

One of the easiest ways to transfer files to your TiVo is via FTP, using the tivoftpd FTP server. You should have copied the tivoftpd program file to your /var/hack directory when your A drive was mounted in your PC. Verify that the program file is still there by typing:

cd /var/hack [ENTER]

/var/hack/bin/ls -l [ENTER]

This will display the contents of the /var/hack directory, and you should see the tivoftpd file that you copied there from the Boot CD. Move the tivoftpd file into the bin directory by typing:

mv tivoftpd /var/hack/bin [ENTER]

Now move into the /var/hack/bin directory by typing:

cd bin [ENTER]

Change the permissions on the tivoftpd file to execute by typing:

chmod 755 tivoftpd

Start the FTP server manually by typing:

./tivoftpd [ENTER]

Now try connecting to your TiVo’s IP address with an FTP client. You can use the Windows command line client by pressing Start, Run, and then typing:

ftp 192.168.1.102 [ENTER]

Make sure you use your TiVo’s actually IP address in the above example. Press ENTER twice when your TiVo’s FTP server responds to log in, then type:

bye [ENTER]

To close the connection. Congratulations! You’ve installed an FTP server on your TiVo!

4.4      Using http_get to download files to your TiVo

In addition to downloading files to your PC and then transferring them to your TiVo via the File Transfer Protocol (FTP), you can also use the http_get command from the bash prompt to download files on the Web directly to your TiVo via the Hyper-text Transfer Protocol (HTTP).

 

The http_get command is already installed in your TiVo, so you don’t need to download anything additional to get it working. All you have to do is type the http_get command from the bash prompt and include the following:

 

·        the remote location and filename of the file you want to download

·        the local directory where you want to save the downloaded file on your TiVo

·        a couple of required arguments (-T and -C) that can simply be set to zero

 

The entire command looks like this:

http_get -T 0 -C 0 -D /dir -U http://ipaddress:port/filename [ENTER]

In the above example, you need to replace /dir with the name of the directory where you want to save the downloaded file (such as /var/hack), replace the ipaddress with the IP address of the remote server (TiVo can’t resolve DNS so you can’t use a domain name), replace the port with the port number that were HTTP server is located on the remote server (which is normally 80), and replace the filename with the location and name of the file on the remote server.

 

Give it a try. To download the popular TiVoWeb program directly to your TiVo from the Web, type the following from your TiVo’s bash prompt:

cd /var/hack [ENTER]

http_get -T 0 -C 0 -D /var/hack -U http://216.168.47.137:80/tivoweb.tar.gz [ENTER]

Wait a few moments as your TiVo downloads the tivoweb.tar.gz file to your /var/hack directory. And since you’ve already gone through the trouble to download the file, you may as well install it now!

4.5      Installing TiVoWeb

TiVoWeb is one of the most popular programs currently in use among TiVo hackers. It was written by Josha Foust (a.k.a. Lightn of the AVS Underground), and it allows you to access most of your TiVo’s on-screen functions, as well as a host of additional functions that are not accessible via your TiVo’s standard menus, all through a Web browser. The latest version of TiVoWeb is written in Tool Command Language (TCL) - a relatively new and powerful language that is perfect for programming on the TiVo. You can find more details on the TiVoWeb Project at http://tivo.lightn.org/.

 

To install TiVoWeb, first make sure you’re in the directory where you downloaded the TiVoWeb distribution by typing:

cd /var/hack [ENTER]

Uncompress the file you just downloaded by typing:

gzip -d tivoweb.tar.gz [ENTER]

Now extract the contents of the tar file with:

cpio -H tar -i < tivoweb.tar [ENTER]

This command will create a new directory called tivoweb-tcl and extract the contents of the tar file into the tivoweb-tcl directory.

 

Start the TiVoWeb program by typing:

 

/var/hack/tivoweb-tcl/tivoweb console

This tells TiVoWeb that you are running the program from the console (the shell prompt) and that you want the program to output any messages to the console. This will allow you to make sure everything worked during the installation. You’ll see a few messages as it loads itself into memory, and then you should see:

Accepting Connections

You can hit ENTER to get your shell prompt visible again. Now fire up your Web browser and type in the IP address of your TiVo.  You should see the TiVoWeb interface in your browser. All the main TiVoWeb stuff is in the “User Interface” section.

5         Starting Programs Automatically When Your TiVo Boots

If you would like your TiVo to run programs automatically when it boots (such as the tivoftpd and TiVoWeb programs you just installed), you’ll need to include the commands to run these programs in one of your TiVo’s startup files. Since you’ve already created an rc.sysinit.author file when you mounted your TiVo’s drive in your PC to enable telnet access, you can once again add the necessary commands to load your new hacks in that file.

 

Remember - when your TiVo boots, it checks for the existence of an rc.sysinit.author file in the same directory as your main rc.sysinit startup file (which, if you don’t remember, is /etc/rc.d). If the rc.sysinit.author file exists in that directory, your TiVo runs that file immediately after it finishes running rc.sysinit. Creating an rc.sysinit.author file to load programs is much safer than editing your rc.sysinit, since a small mistake in rc.sysinit can prevent your TiVo from booting. Also, just like rc.sysinit, your rc.sysinit.author should exist on both partitions 4 and 7.

 

First move to the root directory by typing:

cd / [ENTER]

Now, find out which partition (either 4 or 7) is currently mounted on root as the active partition. Do this by typing:

df [ENTER]

You should get something that looks like this:

 

Filesystem         1024-blocks  Used Available Capacity Mounted on

/dev/hda7             126911   15173   105185     13%   /

/dev/hda9             126911   15898   104460     13%   /var

 

Notice that partition 9 (/dev/hda9) is mounted to the /var directory. That’s where your /var/hack directory is located with all your hack files. But what you are really interested in is which partition is mounted on root (/). In the above example, the “hda7” tells you that partition 7 of hard drive “a” (the IDE channel 1 MASTER) is mounted to the root directory. This means that partition 7 is currently your active partition, and you can then deduce that partition 4 is your inactive partition.

 

If your output to the df command looks like this:

Filesystem         1024-blocks  Used Available Capacity Mounted on

/dev/hda4             126911   15173   105185     13%   /

/dev/hda9             126911   15898   104460     13%   /var

 

Then partition 4 is your active partition, and partition 7 must be your inactive partition.

 

Since the active partition (whether it’s 4 or 7) is already mounted on the root, you will need to mount the inactive partition in order to edit your rc.sysinit.author file there. It’s important to always remember that any time you make changes to rc.sysinit or rc.sysinit.author, you need to do so on both partitions 4 and 7.

 

If your active partition is 7, mount partition 4 it with the following:

mount /dev/hda4 /mnt [ENTER]

Or, if your active partition is 4, mount partition 7 it with the following:

mount /dev/hda7 /mnt [ENTER]

If you get an error like:

mount: you must specify the filesystem type

Then you’ve probably tried to access either a device or a partition that doesn’t exist. If you’re missing partition 4 or 7 as a result of a capacity upgrade, then just ignore the error and make the changes in this section to your active partition only. If your TiVo does have both partitions, then you probably mistyped the device name (like typing hdc instead of hda). Remember that since the drive is re-installed in your TiVo, it is currently mounted on the IDE channel 1 MASTER device, or hda. It is not mounted on the IDE channel 2 MASTER device, or hdc, like it was when it was connected to your PC. Make sure you mount the partitions in these steps using the correct device name, which is hda.

 

Once you’re successfully mounted to your inactive partition, type:

df [ENTER]

You should now see the same file systems as before, except that your inactive partition will now be mounted to /mnt.

 

By default, partitions 4 and 7 for your TiVo are mounted with read only permissions, meaning you can’t make any changes to them. So before you can create an rc.sysinit.author file, you need to remount the file system with read/write permissions. Do this by typing:

mount -o remount,rw / [ENTER]

Now you can move to the location where your TiVo will look for rc.sysinit.author when it boots by typing:

cd /etc/rc.d [ENTER]

Create a new rc.sysinit.author file by typing:

/var/hack/joe rc.sysinit.author [ENTER]

Use the arrow keys to scroll down to a blank line, and then type the following two lines:

 

/var/hack/bin/tivoftpd &

/var/hack/tivoweb-tcl/tivoweb

 

Press CTRL+K followed by the X key to save the file and exit.

 

Now copy your updated rc.sysinit.author file to the inactive partition by typing:

cp rc.sysinit.author /mnt/etc/rc.d [ENTER]

When you are done, be sure to remount your file system back to read only before rebooting, since leaving your file system with read/write permissions during a reboot could cause possible data corruption. Do this with:

mount -o remount,ro / [ENTER]

sync [ENTER]

The sync command forces the file system to write any cached files to disk so you will avoid possible data corruption when you reboot. Now it’s time to reboot and test your work! Type:

reboot [ENTER]

and your TiVo will reboot. When it’s done booting, try accessing your TiVo via FTP and a Web browser once again to make sure you entered the commands properly in your rc.sysinit.author file.

 

In the future, if you install additional programs on your TiVo that you would like to run when TiVo boots, you can simply follow the instructions in this section again to edit your rc.sysinit.author file, and place the start command for the new program on a new line in the file.

6         Including your Hack Binaries in your PATH for Easy Access

While accessing your TiVo via the shell, it's a good idea to include the location of your hack files in your TiVo's PATH so they'll be available to you regardless of which directory you are in. You can add additional directories to your PATH by including a PATH statement in your default profile, which is stored in a file called .profile (that's DOT profile) in the root directory. The .profile file is always run by the shell whenever you log in, so it's a perfect place to tell TiVo what some of your preferences (such as your PATH) should be.

6.1      Verify your current PATH

Use your telnet client to log into your TiVo’s shell. See what your current PATH is by typing:

echo $PATH [ENTER]

You should get a response that looks like this:

/bin:/sbin:/tvbin:/devbin

This tells you that the /bin, /sbin, /tvbin and /devbin directories are currently in your PATH.

6.2      Creating your .profile file

Change to the root directory by typing:

cd / [ENTER]

Before you can write anything to this partition, however, you need to mount it as read/write by typing:

mount -o remount,rw / [ENTER]

Now use the joe editor to create a new file in the root directory called .profile by typing:

/var/hack/joe .profile [ENTER]

Once joe opens and tells you you're creating a new file, type in the following:

export PATH=$PATH:/var/hack:/var/hack/bin

This tells your system to set the PATH to the current path (which is $PATH), as well as the /var/hack and /var/hack/bin directories. It’s important to always refer to the directory names starting from the root (using the "/") and separate each different directory name with a colon (don't use a semi-colon like you would with MS-DOS PATH statements).

 

Save the file and exit joe by pressing CTRL+K then X. Remember to remount your file system as read only with:

mount -o remount,ro / [ENTER]

sync [ENTER]

Now log out of your TiVo by typing:

exit [ENTER]

Telnet back in to your TiVo, then check to see if your new PATH is in effect by typing:

echo $PATH [ENTER]

You should get a response that looks like this:

/bin:/sbin:/tvbin:/devbin:/var/hack:/var/hack/bin

Test out your PATH statement by typing:

ls [ENTER]

Since the ls command is stored in the /var/hack/bin directory (which is one of the directories listed in your path), you should see a directory listing! You can also verify your .profile file is in the right location by typing:

cd / [ENTER]

ls -a [ENTER]

The "-a" option shows "all" the files in the directory, including hidden files, which always starting with a period. So your .profile file wouldn't show up with an ordinary ls command, but it will with an ls -a.

 

Congratulations! You've just edited your PATH to include your hack binaries!

7         Automating READ/WRITE and READ ONLY switching in the file system

As was mentioned in an earlier section, the TiVo implementation of Linux keeps certain partitions of its file system (such as the system root) mounted with read only permissions when you log in to the shell. In order to make any changes to system files, install some programs, or otherwise write anything to a disk in these partitions, you need to remount the file system with read/write permissions.

 

Partition 9 (which is mounted to your TiVo’s /var directory) is automatically mounted as read/write. But partitions 4 and 7 (which contain files such as your rc.sysinit, rc.sysinit.author, and .profile) are mounted as read only. If you ever want to change these files, or create new files in these partitions, you need to remount them as read/write before doing so.

 

Remounting the file system with read/write permissions is simple enough, you can just type:

mount -o remount,rw / [ENTER]

As you could probably tell, the "rw" stands for "read/write".  When you remount the file system with read/write permissions, however, you MUST remember to remount with read/only permissions BEFORE logging out of your TiVo. Do this by typing:

mount -o remount,ro / [ENTER]

This is important because changes made to the TiVo’s file system aren't immediate. Instead, they're cached and written in bulk to speed up disk access. It's entirely possible that you could edit your rc.sysinit file, reboot, and then loose all your changes or corrupt the file system if only part of your changes have been written.

 

There are no file system checks on startup for the root partition since it's expected to be read only. This basically means that you either need to remember to remount the root read only (which forces a write and marks the file system as clean) or run the sync command (which forces a write).

 

But instead of remembering to typing these commands every you log in and out of your TiVo, there is an easier way! You can automate the remounting commands using a combination of your .profile file, aliases, scripts, and a .bash_logout file.

7.1      Understanding different levels of remount automation

There are different levels of remount automation that you can choose from, and different types of users will choose different approaches. Here are the three main methods used to automate this process:

 

Method 1: Fully Automatic. Your system is automatically remounted as read/write when you log in, and is automatically remounted as read only when you log out. This method may seem very convenient, but it could cause problems if you inadvertently do something to cause the TiVo to reboot without having a chance to properly log out, and it could lead to potential file corruption. Use this method ONLY of you are an expert and know what you are doing. This automation method won't be addressed here, since if you are expert enough to think that you REALLY need this, then you're expert enough to set it up without help.

 

Method 2: Fully Manual. Using scripts, you can manually remount your file system as read/write when you need too, but you must remember to manually run another script to remount as read only before you log out. This is not the recommended method, since if you forget to remount to read only before logging out, you could corrupt your system.

 

Method 3: Semi-Automatic. With a couple of simple scripts, you can manually remount your file system as read/write any time you need to, and you can manually run another script to remount as read only at will - but as an extra safety precaution, your file system will be automatically remounted as read only whenever you log out. This is the recommended method, and the one that will be explained below.

 

In order to make the necessary changes to your system, however, you will need to manually remount your file system with read/write permissions by typing:

mount -o remount,rw / [ENTER]

7.2      Writing the automation scripts

Start by writing a couple of simple scripts than will set the file system permissions you want. Create a new subdirectory of your hack directory to store your scripts by typing:

cd /var/hack [ENTER]

mkdir scripts [ENTER]

Now change into the scripts directory with:

cd scripts [ENTER]

Using the joe editor, create one script for remounting as read/write and another for remounting as read only. Create the first script (called makero.sh) by typing:

joe makero.sh [ENTER]

The joe editor will open a new file. Type the following lines:

 

#! /bin/bash

mount -o remount,ro / \

&& echo "File system is now READ ONLY." \

|| echo "Remount Failed!"

 

Make sure there are no blank lines in the script, especially if you copied and pasted the above lines from your browser into your telnet client. This script should contain exactly four lines. The trailing backslash (\) at the end of lines 2 and 3 are actually telling the script to continue with the following line as if it were part of the same line, so make sure you are using the correct slashes in the correct places, or you’ll get error messages when you try to run the script.

 

Press CTRL+K then X to exit and save your file.

 

Now make the second script (called makerw.sh) by typing:

joe makerw.sh [ENTER]

Type the following lines:

 

#! /bin/bash

mount -o remount,rw / \

&& echo "File system is now READ/WRITE." \

|| echo "Remount Failed!"

 

Again, verify that there are no blank lines in your script. Press CTRL+K then X to exit and save your file.

 

Once you've written both scripts, you need to make them both executable by typing:

chmod 755 * [ENTER]

7.3      Creating aliases in your .profile file

Now that you’ve written a couple of scripts that can remount the file system, you’re ready to create some simple aliases in your .profile file that can invoke them at will. An alias is essentially a shortcut to typing a long string of text. You can alias a short piece of text instead, as we’ll do below with the two scripts you wrote above.

 

Change to the root directory by typing:

cd / [ENTER]

Edit your .profile file by typing:

joe .profile [ENTER]

The joe editor should open your .profile. Place the following lines at the end of your .profile file:

 

alias rw='/var/hack/scripts/makerw.sh'

alias ro='/var/hack/scripts/makero.sh'

 

When you’re finished editing your .profile file, press CTRL+K then X to exit and save your file.

7.4      Creating a .bash_logout file

Whenever you properly log out of your shell session, TiVo looks for a file called .bash_logout in your home directory. If it finds a .bash_logout file, it follows the instructions in there prior to logging out of the shell. By default, your home directory is the root directory. Move into your home directory by typing:

cd [ENTER]

Typing the cd command with no other options will always place you in your home directory.

 

Now use the joe editor to create a .bash_logout file:

joe .bash_logout [ENTER]

Place the following two lines at the top of the file:

 

mount -o remount,ro /

sync

 

Exit and save your file by typing CTRL+K then X. Make sure your .bash_logout file is executable by typing:

chmod 755 .bash_logout [ENTER]

Your .bash_logout file will be run whenever you properly log out of your shell session. But just to be safe, manually remount your file system as read only before logging out and logging back in by typing:

mount -o remount,ro / [ENTER]

sync [ENTER]

7.5      Testing your automation settings

Now you’re ready to test your work. Log out of your TiVo by typing either:

exit [ENTER]

or

logout [ENTER]

and wait until your TiVo closes the connection. Simply closing your telnet client while you are logged in does not log you out properly, and you are risking file corruption by doing so.

 

Log back in to test your settings. Once you log in, you should be able to type:

rw [ENTER]

and receive a message that your file system is now mounted as read/write. Change them back to read only by typing:

ro [ENTER]

If something doesn’t work properly, you should get a “Remount Failed!” message. Try to remember to type the ro command before your log out of your TiVo, or after you are done making changes in your file system on partitions 4 or 7. But even if you forget, your.bash_logout file is there to automatically remount as read only before you end your shell session, as long as you always terminate your session properly with “exit” or “logout.”

8         Editing your .profile file

As you learned above while creating aliases for your read/write and read only scripts, your .profile file is a useful place for placing shortcuts (known as aliases) to help speed up commands. But the .profile file is much more powerful than that. You can edit your .profile file to configuring how your system will look and act while you’re logged in. This section will walk you through modifying your system PATH, editing your prompt, and adding other aliases.

8.1      Editing your PATH

A systems PATH is the directories the system looks in when trying to evaluate a command you’ve typed in. Your system will look in the directories in your PATH in the order those directories appear. For example, to see your current PATH, simply type:

echo $PATH [ENTER]

Make sure you put the $PATH in all upper case letters. This shows various directories in the order that your system will examine them when trying to process a command you type in. The default PATH should look something like this:

/bin:/sbin:/tvbin:/devbin

Meaning when you type in a command, it will first look in the /bin directory. If it can’t find the command, it looks in the /sbin, then the /tvbin, and finally the /devbin directories. If the command wasn’t found in any of those directories, then you’ll get a “command not found” error.

 

It’s a good idea to add your newly-created hack directories to your PATH to make running commands in those directories simpler. So edit your .profile file to add your hack directories now.

 

Change to the root directory by typing:

cd / [ENTER]

Edit your .profile file by typing:

/var/hack/joe .profile [ENTER]

The joe editor should open your .profile file. Place the following lines at the top of your .profile file:

export PATH=$PATH:/var/hack:/var/hack/bin:/var/hack/scripts

What you just typed means that when you log in, the system should keep the default PATH (which is $PATH), then add those three other directories. You can add any additional directories you want, as long as you separate the directories in your PATH with a colon, as shown in the example.

8.2      Editing your Prompt

While you’ve got your .profile file open for editing, you can modify your default bash prompt (where you type in commands to your TiVo) by setting the PS1 variable. To make your prompt the same as mine, add the following line to your .profile:

PS1='TiVo: {\w} % '

The \w option displays the current “working” directory (the directory you’re in). So if I were in the /var/hack directory, my prompt would looks like this:

TiVo: {/var/hack} %

If I editing my prompt to the following:

PS1='TiVo: {\t} % '

My prompt would look like this at 8:15 am and 32 seconds:

TiVo: {08:15:32} %

You can experiment with other special character codes in your prompt, and you can include multiple special character codes for a variety of results. Here are a few you can play with:

 

\!  Displays the history number of this command. 

\#  Displays the command number of the current command. 

\$  Displays a $ in the prompt unless the user is root. When the user is root, it displays a #. 

\\  Displays a backslash. 

\d  Displays the current date. 

\h  Displays the host name of the computer on which the shell is running. 

\n  Prints a newline character. This causes the prompt to span more than one line. 

\s  The name of the shell that is running. 

\t  Displays the current time. 

\u  Displays the username of the current user. 

\W  Displays the base name of the current working directory. 

\w  Displays the current working directory. 

 

Then , you can add some directories to your system’s default PATH so you can run scripts, binaries, and other hacks without worrying about changing to the appropriate directory first. So add the following line, too:

8.3      Adding More Aliases

Finally, while you’re editing your .profile file, I suggest adding any or all of the following aliases.

 

This alias allows you to type in double lower-case L to see a colorized long listing (my favorite type of listing):

 

alias ll='ls -la --color'

 

This alias allows you to show the currently installed modules simply by typing lsmod:

 

alias lsmod='cat /proc/modules'

 

Exit and save your file by typing CTRL+K then X.  You’ll need to log out and then log back in to your TiVo to see any changes controlled by your .profile file.

9         Setting up a static IP address

By default, your TiVo is set to get the information it needs about how to access your local network from what’s called a DHCP server. If you’re using a cable or DSL router, there’s a very good chance that this device is also acting as the DHCP server for your network. When your TiVo boots, it requests three pieces of information from the DHCP server: 1) an IP address to uniquely identify your TiVo on your network, 2) the subnet mask (also known as a netmask) for the network your TiVo participates in, and 3) the default gateway through which your TiVo should attempt to route all outbound network requests. The problem with using DHCP on your TiVo, however, is that every time your TiVo reboots, the IP address you use to access it (such as accessing TiVoWeb, the FTP server, etc.) will probably change. This is what’s known as a dynamic IP address, or one that changes on every boot. Many hackers find it useful to assign a static IP address (one that doesn’t change) to their TiVo so they don’t have to search for the new IP address after every boot. In this part of the guide, you’ll learn how to identify the information required for your TiVo to access your network, and then edit one of the startup scripts on your TiVo to permanently put in those three pieces of information required by your TiVo to access your network.

9.1      Finding the info you’ll need

As was mentioned above, you need to find the following information about your network in order to assign a static IP to your TiVo:

 

1)     IP address range used by your DHCP server

2)     Subnet mask

3)     Default gateway

 

If your PC uses DHCP to get this information (and it probably does) then you’re in luck. Just open a command prompt on your PC by pressing START, then Run… and then type:

cmd[ENTER]

This will open a command prompt window. Next type:

ipconfig [ENTER]

The resulting information will probably look a little bit like this:

 

Windows IP Configuration

 

Ethernet adapter Local Area Connection:

 

        Connection-specific DNS Suffix  . :

        IP Address. . . . . . . . . . . . : 192.168.1.100

        Subnet Mask . . . . . . . . . . . : 255.255.255.0

        Default Gateway . . . . . . . . . : 192.168.1.1

 

Take note of the last three lines. You will need to configure your TiVo to have a different IP address than your PC (otherwise there will be a conflict and one of the two won’t be able to use the network), but have the same subnet mask and default gateway.

 

The next piece of information you’ll need is the IP address range of your DHCP server. For our purposes, we’ll assume your DHCP server is your cable/DSL router, because if you’re using a different DHCP server on your network then you probably know how to get this information anyway.

 

Open up the admin Web interface for your router. For Linksys routers, you can do this by going to 192.168.1.1 with your Web browser. Once you’re in the admin interface, go to the section that allows you to enable or disable DHCP on your router (most are called Setup). In this section, you should also see the starting IP address (which is 192.168.1.100 by default on Linksys routers) and the maximum number of DHCP users (which is 50 by default on Linksys routers). This means that your DHCP server reserves the right to assign any IP address between 192.168.1.100 and 192.168.1.150 any computer on your network that requests one. Since we don’t want your TiVo to interfere with any dynamic IP addresses on your network, you will need to choose a static IP address that is outside this range. To be safe, we’ll use 192.168.1.200 as the static IP for your TiVo. Of course, if you’re setting up more than one TiVo with a static IP address, you will need to use a unique IP address for each.

9.2      Editing your rc.net file

Now that you have all the necessary information to allow your TiVo to access your network with a static IP address, you need to edit the TiVo’s startup scripts responsible for your network setup, which is called rc.net. The file is located in the same directory as the two startup scripts you’ve previously dealt with, rc.sysinit and rc.sysinit.author.

 

Change to directory where your TiVo keeps its startup scripts:

cd /etc/rc.d [ENTER]

Remember, before you can edit any files on this partition, you need to mount it as read/write by typing:

rw [ENTER]

Make a backup of your original rc.net file by typing:

cp rc.net rc.net.bak [ENTER]

Now edit your rc.net file by typing:

joe rc.net [ENTER]

The default rc.net file on a Series 1 TiVo looks like this:

 

#!/bin/bash

# Copyright (c) 2001-2002 TiVo Inc.

#

 

if [ "$DEBUG_BOARD" != true -o "$dhcp" == true ]; then

  if detectDynamicNet; then

    mkdir -p /var/state/dhcp

    /sbin/dhclient -q "$DYNAMIC_NET_DEV" 2>/dev/null &

  fi

fi

 

Comment out lines 7 and 8 by putting a number sign at the beginning of the line, as shown in the example below. These two lines tell your TiVo to request a dynamic IP address from the DHCP server, so you’ll want to tell your TiVo to ignore these lines when it starts up. Next, insert lines 9 and 10 as shown in the example rc.net file below, using your desired static IP address and subnet mask on line 9, and your default gateway on line 10. Your newly edited rc.net file should look somewhat like this:

 

#!/bin/bash

# Copyright (c) 2001-2002 TiVo Inc.

#

 

if [ "$DEBUG_BOARD" != true -o "$dhcp" == true ]; then

  if detectDynamicNet; then

#    mkdir -p /var/state/dhcp

#    /sbin/dhclient -q "$DYNAMIC_NET_DEV" 2>/dev/null &

     /sbin/ifconfig eth0 192.168.1.200 netmask 255.255.255.0 up

     /sbin/route add default gw 192.168.1.1

  fi

fi

 

Press CTRL+K followed by the X key to save the file and exit.

 

When you are done, be sure to remount your file system back to read only before rebooting, since leaving your file system with read/write permissions during a reboot could cause possible data corruption. Do this with:

ro [ENTER]

sync [ENTER]

The sync command forces the file system to write any cached files to disk so you will avoid possible data corruption when you reboot. Now it’s time to reboot and test your work! Type:

reboot [ENTER]

and your TiVo will reboot. When it’s done booting, try accessing your TiVo via FTP and a Web browser using your static IP address to make sure everything went OK. It’s also a good idea to use your TiVo’s remote to go into Messages and Setup make a test call, just to make sure your TiVo can still download guide data during its daily call.

 

Congratulations! You’ve given your TiVo a static IP address!

10   Mark your TiVo as Hacked!

Click to download this stickerNow that you’ve successfully hacked your TiVo, you can download my unofficial “Hacked!” sticker to let everyone know that your TiVo is “pumped up!” Print out the sticker onto some clear adhesive laser printer paper (which is specially designed for printing your own stickers) and place it proudly in your newly hacked TiVo.

 

The zip file in this link contains the sticker image in GIF and PSD (PhotoShop) format, with a transparent background for printing on transparent paper.

 

http://tivo.stevejenkins.com/downloads/sticker.zip

11   Acknowledgements

Special thanks go to the following for their help, suggestions, corrections, support, and advice:

 

Everyone in the AVS TiVo Underground at TivoCommunity.com - for mounds of excellent advice, help, and support (both technical and emotional).

 

Everyone in the DealDatabase.com Forums - for mounds of excellent advice, help, and support (both technical and emotional).

 

Tiger, embeem, wysiwyg3, and lightn – for their explanations and help with file system read/write and read only remount mounting.

 

sorphin – for creating tivoftpd.

 

lightn – for creating the TiVoWeb Project.

 

gleffler – for his instructions on making the TiVo daily call via Ethernet.

 

dsmdriver – for his telnet with 3.0 instructions.

 

9thTee.com – for selling me my first TiVo Ethernet adapters, and for their long-time dedication to the TiVo hacker community.

 

TiVoJoe.com – for selling me my first hard drive upgrade kit, for the cool install video, and for the Tootsie rolls.

 

Carlton Bale – for all his hard work on TiVoHelp.com and help in making my instructions available to beginning TiVo hackers.

 

kazel – for being the first newbie TiVo hacker brave enough to actually follow these instructions, and for providing excellent feedback to help improve them for future readers.

 

John Oram – for his help in debugging the DirecTiVo variations in this guide.

 

and finally…

 

TiVo, Inc. – for making such a fun product to use and mess around with, and especially for being so tolerant and supportive (even though they can’t be “officially” supportive) of the TiVo hacking community.

 

 

If you found this guide helpful, please consider donating!

Back to http://tivo.stevejenkins.com/