Hacking a Series 2 TiVo
This is merely an outline of how to hack your Series 2 DirecTiVo or stand alone unit. New hacks are literally created every day, so this format will best allow me to easily make any updates as preferred hacking methods change. External links are provided for step-by-step information. You'll notice most of the links will take you to the DealDatabase Forum, which is probably the best source of information for hacking your TiVo.
TiVo uses the Linux operating system on a MIPS processor. We will be using the command prompt exclusively. Some Windows commands are the same in Linux, while others are different, but work the same as in Windows. Some Linux experience is very helpful, but not absolutely necessary. There are some subtle differences between Linux running on a PC and the version that runs on the TiVo.
Please realize that by merely opening your TiVo your warranty will be null and void. Before you begin, make sure there is nothing recorded on the Tivo (Now Showing) that you can't live without. Also, write down your Season Passes, Wishlists, one-time recordings (check the To Do list), and any other settings you think you might need in case you toast your TiVo. If you only have one computer and wish to minimize reboots and reconnecting drives, be sure to read through this first, print out the relevant information, and download the necessary files before getting your hands dirty.
USB Network Adapter
The TiVo does not have any security whatsoever. Anyone who can get to its IP address will have full access to the filesystem, and can view, record, and delete your shows, Season Passes, etc. Make absolutely certain your TiVo is behind your router's firewall. No external ports should be forwarded to the TiVo's IP address, nor should it be in the DMZ.
The TiVo Replacement Hard Drive
The Second Drive
On this second drive, you'll need a few downloaded files. Here's how to get them...
Unzip the killhdinitrd*.zip file and copy the files over to your second drive. Rename the virgin kernel file to vmlinux.px if it isn't already. Copy that over to the second drive. If the kernel file you downloaded ends with a .tar or .gz extension, it is compressed using a Linux compression format. For simplicity, uncompress these files before you copy them over to the secondary drive. I recommend using 7-Zip as it supports all the compression formats listed in this guide.
Extract tivotools.tar from the tivotools.tar.rar file on the second drive. Again, 7-Zip will handle this task flawlessly.
Copy iptables and rc.sysinit.author over to the second drive as well.
Linux Boot CD
Here is a quick and dirty Linux command line primer...
Follow the Hinsdale How-To. This is an excellent guide for backing up and restoring the TiVo software to a larger drive. If you using a serial ATA (SATA) hard drive, USB hard drive enclosures, external drives, or flash memory drives, see the next section for some help. Be sure to test that your new hard drive works in your TiVo before continuing. For DirecTiVo owners, you might want to force a few calls because this is the last chance it will have to update itself. Allowing a DirecTiVo to call in after it is hacked is not recommended. If you lose your local channels, check out this tip. If you need or want a clean image of the latest TiVo software for your device, consider purchasing an Instant Cake CD from dvrupgrade.com for $19.99. This CD has a simple wizard that installs the image on your hard drive.
First you need to create new directories which you will use to access the various drives and their partitions.
mkdir /mnt mkdir /mnt/dos mkdir /mnt/hda4 mkdir /mnt/hda7 mkdir /mnt/var
In the example above, we are creating a mnt directory to mount our hard drive partitions. The /mnt/dos directory is for our FAT or FAT32 partition which will have the files we are going to work with. Then, we create directories for the 4th, 7th, and 9th (var) partitions on the TiVo drive.
Now we need to mount the drives. For hard drives using the IDE/EIDE/Parallel ATA (PATA) interface, Linux refers to it as hdxy where x is a letter (a-z) specifying the drive, and where y is a number (1, 2, 3, etc.) representing a partition on the drive.
hda - first/primary IDE interface, master drive
For serial ATA (SATA) or USB hard drive enclosure or flash drive, Linux calls them sdxy where x is a letter (a-z) referring to the drive on a particular SATA interface, and where y is a number (1, 2, 3, etc.) representing a partition on the drive.
So, if I wanted to mount a USB flash drive with a FAT32 partition, I would use the following command:
mount /dev/sda1 /mnt/dos
Now, I need to mount my TiVo drive partitions:
mount /dev/hda4 /mnt/hda4 mount /dev/hda7 /mnt/hda7 mount /dev/hda9 /mnt/var
Don't be too alarmed if you see some messages or warnings. Use the cd and ls -l commands to make sure your drives are configured correctly. If you TiVo has never upgraded itself or you are using a clean image, there may not be anything on hda7. It can be tricky to find and mount the correct serial drive. If you mount the wrong drive, use the umount command to unmount and try again. Example:
Copy the vmlinux.px to /mnt/var and run the killhdinitrd program on it. An example follows. It may or may not be the right commands depending on your file names and locations.
cp /mnt/dos/vmlinux.px /mnt/var /mnt/dos/killhdinitrd /mnt/var/vmlinux.px
Follow the on-screen prompts to patch the kernel file. Once that is done, apply the kernels to the two root partitions...
dd if=/mnt/var/vmlinux.px of=/dev/hda3 dd if=/mnt/var/vmlinux.px of=/dev/hda6
...where /mnt/var/vmlinux.px refers to the patched kernel file.
Prevent Software Upgrades
bootpage -p /dev/hda
You should get one of two possible responses:
This tells you which partition the TiVo drive boots from. The TiVo has two root partitions with one being the primary partition. Whenever TiVo downloads and installs a software update, it does so on the alternate partition. If something goes wrong with the software update, the TiVo can still boot up with the other partition. Clever, huh?
If it's hda4, enter this command:
bootpage -P "root=/dev/hda4 dsscon=true console=2,115200 upgradesoftware=false" /dev/hda
Otherwise, enter this command:
bootpage -P "root=/dev/hda7 dsscon=true console=2,115200 upgradesoftware=false" /dev/hda
The "/dev/hdax" inside the quotation marks refers to the drive as it is connected in the TiVo. In most cases, you will not modify this. If you TiVo drive is currently set to slave or on the secondary IDE interface of your PC, you will need to modify the /dev/hda at the end of the line to refer to the proper drive.
These instructions are also available in the killhdinitrd support thread. Note the bootpage commands may not work with some Linux boot CD's. You will have to issue the commands from a telnet session when we get to that point.
All-In-One S2 Utilities Collection (a.k.a. TivoTools)
mkdir /mnt/hda4/tivo-bin mkdir /mnt/hda7/tivo-bin tar -xvf /mnt/dos/tivotools.tar -C /mnt/hda4/tivo-bin tar -xvf /mnt/dos/tivotools.tar -C /mnt/hda7/tivo-bin
The first 2 commands create a tivo-bin directory on both boot partitions. (If you were not able to mount partition 7 earlier, don't sweat it.) The third and fourth commands will extract the files into the newly created tivo-bin directories. This is per the instructions in the All-In-One S2 Utilities Collection thread.
For software versions 6.2a or below, enter these commands...
cp /mnt/hda4/etc/netfilter-enable /mnt/hda4/etc/netfilter-enable.bak cp /mnt/hda4/etc/netfilter-disable /mnt/hda4/etc/netfilter-enable mv /mnt/hda4/sbin/dhclient /mnt/hda4/sbin/dhclient.bak cp /mnt/hda7/etc/netfilter-enable /mnt/hda7/etc/netfilter-enable.bak cp /mnt/hda7/etc/netfilter-disable /mnt/hda7/etc/netfilter-enable mv /mnt/hda7/sbin/dhclient /mnt/hda7/sbin/dhclient.bak
That should take care of the networking filters on both root partitions. If you receive any errors, don't worry. It just means there is an older software version on that partition that doesn't have the filters in place. If you want to enable DHCP, do not enter the dhclient commands (renames the dhclient). Your router will automatically assign your TiVo an IP address. You'll have to go into your router, though, to see what IP address it assigned your TiVo box in order to access it.
For everything above version 6.2a, do this:
mv /mnt/hda4/sbin/iptables /mnt/hda4/sbin/iptables.bak cp /mnt/dos/iptables /mnt/hda4/sbin/ chmod 755 /mnt/hda4/iptables mv /mnt/hda7/sbin/iptables /mnt/hda7/sbin/iptables.bak cp /mnt/dos/iptables /mnt/hda7/sbin/ chmod 755 /mnt/hda7/iptables
Essentially, we are renaming the iptables file and copying a new, hacked one over. Then we make it executable. Don't sweat it if the hda7 commands do not succeed. If you want to use a dynamically assigned IP address, you'll need to find a dhclient file somewhere and copy it to the sbin folder. (Information shamelessly copied from here.)
cp /mnt/dos/rc.sysinit.author /mnt/hda4/etc/rc.d cp /mnt/dos/rc.sysinit.author /mnt/hda7/etc/rc.d
That is the lazy way. You will probably need to edit my file at some point, and you should know how to edit the file on your TiVo, and what the file does. This is optional, but helpful...
Issue this command to create and/or edit the rc.sysinit.author file:
This starts up the VI editor. I'm not going to tell you how to use it as there are many, many websites that explain the VI editor in detail. Do a search.
Here is what my rc.sysinit.author looks like:
export PATH=$PATH:/sbin:/bin:/tvbin:/tivo-bin:. export TIVO_ROOT= export MFS_DEVICE=/dev/hda10
#start bash #/bin/bash /dev/ttyS2& /bin/bash</dev/ttyS2&>/dev/ttyS2&
#set the IP address ifconfig eth0 192.168.1.90 broadcast netmask 255.255.255.0 route add default gw 192.168.1.1 netmask 255.255.255.0 metric 1
#start telnet server tnlited 23 /bin/bash -login &
#start ftp server tivoftpd
#run fakecall fakecall.tcl
#start tivowebplus /var/hack/TivoWebPlus/tivoweb
#start mfs_ftp /var/hack/mfs_ftp/mfs_ftp.tcl
The PATH command tells the TiVo where to look, by default, for files. Bash and telnet are already on the TiVo. Tivoftpd and fakecall.tcl are part of the All-In-One S2 Utilities Collection, the path of which we've included in our path statement (/tivo-bin). If necessary, change the IP address of 192.168.1.90 to whatever you want your TiVo to be. The gateway address of 192.168.1.1 should be the same as your router. If you did not rename dhclient earlier, you can delete or comment out these lines. Note we haven't installed tivowebplus or mfs_ftp yet. TiVo will attempt to find the files and execute them, but will fail, and just skip down to the next command.
When you are done, copy the rc.sysinit.author file over to the other root partition...
cp /mnt/hdc4/etc/rc.d/rc.sysinit.author /mnt/hdc7/etc/rc.d/
and set them as executable...
chmod +x /mnt/hdc4/etc/rc.d/rc.sysinit.author chmod +x /mnt/hdc7/etc/rc.d/rc.sysinit.author
Telnet & FTP
While the hard drive is in the TiVo, the 4th and 7th partitions are read only. You will need to issue the following command before you can modify files on those partitions:
mount -o remount,rw /
Last updated September 8, 2012