Hacking the HDVR2 (S2 DTiVo) BASH/Ethernet/Upgrade
I can find a plethora of threads on the S2, but nothing specific to the DTiVo S2, so I decided to create this, it is “newbie-grade”, and will allow others to get an idea of what’s going on with a “hands-on” approach.
I am basing these instructions on my "Test" unit, which is a HDVR2 that shipped with 3.1.U5-01-2-151.
I was tempted to create a automatic utility to do all this for someone, but that way you can’t learn!
Note: The Ethernet adapter is discussed in a later post down in the thread farther!
HOW TO OBTAIN A SERIAL BASH PROMPT and/or UPGRADE CAPACITY:
1. If you don't already have these 5 things you will need them to begin:
a. Torx T-10 Screwdriver
b. An open Windows 95/98 PC, (FAT32) that has at least 2g free space, and will boot from CD. You CANNOT use XP or 2000 with NTFS, as those partition types cannot be written to via the Linux boot CD. (you can also use Linux, but I am not going to detail this here)
c. A copy of the MFSTools2 Boot CD or better yet, the version created by Jonnydeath that includes all of the extra files mlar used in his pioneering effort. Jonnydeath is kind enough to provide this to you as a downloadable ISO image at: http://star1.jongans.com/mfstools2.iso Kudos mlar and Jonnydeath! (download and burn the ISO image to a blank CDR)
d. A spare IDE cable. Type is not too important for this operation.
e. A TiVo PC to 1/8" Serial cable. Instructions for making this are in various locations throughout the forum. Make sure it is done correctly, as I envision this is the most common source of problems. If you don't have decent electronics experience, I suggest you order this cable pre-made from somewhere like 9thtee.
f. (Optionally) A new HD for your TiVo at least Equal or Greater than your originals capacity. I used a 120g Maxtor for mine.
2. Disconnect Power to the TiVo. I recommend you leave the AC plug plugged into a Power strip and just "turn-off" the strip to preserve the Static ground path through the power supply. It is winter after-all!
3. Open the Unit using your Handy T-10 Torx Driver. Note that TiVo seems to have finally given up on the cheesy "Warranty Seal" used extensively on the S1.
4. Disconnect the cables (Power and IDE) from the Hard drive.
5. Remove the Hard Drive and Bracket assembly by removing the two T-10 Torx screws located on the Hard Drive Bracket between the Drive itself and the Front of the TiVo.
6. Treat the hard drive like a waiting heart transplant, and carefully take it to the PC and hook it up as the Secondary Master all by itself. This may require you to unplug your CDROM and reconfigure it as Primary Slave if it is not already like that. This configuration can be varied, but I don't recommend it, as my instructions are going to assume this configuration. Any other IDE devices should be unplugged. So you should have your Windoze FAT32 drive as Primary Master (IDE0), your CDROM as Primary Slave (IDE1), and your TiVo heart as Secondary Master (IDE2). You should not need to change any jumpers on the TiVo drive.
7. Insert the MFSTools2 bootable CD in the drive and boot the PC. You should quickly get a prompt that that asks for boot options. Just hit ENTER. Linux should now boot, and may ask you to login as root. Once logged in you will be at the # prompt.
8. Mount the Windows drive by using the following command: mount /dev/hda1 /mnt/c
9. Verify you can "see" the Windows drive by doing an ls /mnt/c and you should see a directory of your Windows C drive. Also verify you have at least 2 gigs free on that partition by using the df command.
10. No we are going to create a backup of your TiVo drive for safety reasons. Execute the Following Command: mfsbackup -f 4138 -6so /mnt/c/tivo-s2.bak /dev/hdc
This will create a file in the root of your Windows drive called tivo-s2.bak that will contain a complete image of the new TiVo drive, it will be approximately 1.2g in size. Be sure this command completes successfully before you move on to the next step. It took about 5 minutes on my setup, so feel free to go have a snack and Watch something on your Series 1.... ;-)
11. (optional) Now, here is where you choose to play it safe by using a new drive or keeping the original. We have not yet modified the TiVo drive in any way, so by keeping it intact, you have a sure-fire failsafe. I also desired to upgrade my capacity at this point, so I opted for a 120g 5400 rpm Maxtor to replace the existing 40g Maxtor my HDVR2 came with. If you are going to replace the drive, you now use the "three-finger salute" (CTRL-ALT-DEL) to halt Linux (this will safely unmount your windows drive). DO NOT power off the PC until it reboots! Once it reboots, then power it down. Remove the TiVo drive, take the Bracket off, and put it somewhere safe. Mount the bracket on the NEW drive, making sure it is set for Master first. Install it in the PC and reboot just like before, including the step to mount your windows partition. Do not run MFSbackup though!!!
12. Ok, now here is were we reverse the process and restore the backup on your drive. You have to perform this step even if you are re-using the TiVo original drive (not recommended), as we are going to use MFSrestore to create some additional partitions that are not present on your drive already. Note: Leave OUT the "-s 127" if you are re-using the "stock" drive! Your Windows partition should be mounted and ready to go, then type the following command: mfsrestore -s 127 -xzpi /mnt/c/tivo-s2.bak /dev/hdc
This will re-write the backed up data from the Windows drive to the target TiVo drive and add the extra partitions. Once this process completes successfully, reboot the machine with CTRL-ALT-DEL and get back to the # prompt. Do not re-mount the Windows partition. Press and hold SHIFT and use the "Page Up" key to scroll back through the kernel boot messages, looking for the "Partition Check" where it will list all the partitions found on /dev/hdc. Make a note of the LAST hdcXX, with blank line after the name. Also, The line above the blank one we want should list a partition type called "Apple_Free", YOU WILL BE USING THE BLANK PARTITION FOR THE ROMFS STEPS BELOW! Mine was 16, which may not be one used on your drive, but NO MATTER WHAT, THE NUMBER WILL BE OVER 10! If for some stange reason it is not, DO NOT PROCEED! I also recommend You power down the PC at this point and put the New TiVo drive back in the TiVo for a quick test to be sure it worked. Since I was upgrading, I wanted to see the magic 3-digit "recording Capacity" number show up in the System Info screen. It did! YES! =) If all is well, power down the TiVo and put the drive back in the PC and get it back to the # prompt as before.
14. Notice I skipped 13. I didn't want anything to screw up when everything has worked perfectly so far! =) Ok, now this is where we begin the modifications that mlar originally developed to get that prompt! Mount Jonnydeath’s CD by typing mount /dev/hdb /cdrom It will proceed to tell you that it is a read-only file-system, and that is it mounting it accordingly. CD to the mount by typing cd /cdrom then do an ls to verify that the img subdirectory, the genromfs and the bootpage utilities are there. (if they are not, you didn’t use Jonnydeath’s MFStools version!) Now lets verify your system is like mine was, and type this command: bootpage -p /dev/hdc
It should spit out "root=/dev/hda7" which confirms the TiVo’s active root partition is 7, so that makes the VAR mount point at 9. Lets now mount the var partition by typing: mount /dev/hdc9 /mnt/tivo
Then we check it by doing a: ls /mnt/tivo
Now verify you see at least stuff like the "log" and "utils" subdirectories. Now if that is ok, we are ready for the actual modifications. The first chore is to generate the small ROMFS image that we will be placing on the last Blank Partition (determined in step 12). Do this by typing the following: genromfs -f /romfs.img -d img/
This command should create a 1024 byte file in the root directory called romfs.img containing the ROM file system image which has the “hacks” file in it from the img subdirectory. Now we are ready to write it to the blank partition at the end of the TiVo drive. The blank partition we will use was created by us and determined in step 12. Make the write by typing this command:
(Note: The blue XX should be replaced with the blank partition number determined in step 12!) dd if=/romfs.img of=/dev/hdcXX bs=1024 count=1
This command does a direct binary copy (dd) of the “infile” romfs.img directly to the partition which is located at device handle /dev/hdcXX. If all goes well you will see "1+0 records in" and "1+0 records out" and we have inserted our secret “hook” code into the last partiton on the TiVo drive. On to the next step.....
15. Ok, now we have a block of code in the last partiton, and we will still need to “hook” it by passing kernel parameters at boot time by altering the boot page. What this code in the last partition will do is look for a file called “hackinit” in the /var/hack subdirectory and execute it when we "trick" the kernel into running it for us. In that "hackinit" file we can place anything (such as a BASH shell) we wish to have the TiVo run at startup. Now we will create that "hackinit" file and load it with a command to invoke our BASH prompt on the HDVR2’s serial port. Type: mkdir /mnt/tivo/hack
This will create our “hack” directory in TiVo’s var subdirectory. Then type: mkdir /mnt/tivo/hack/bin
And this makes our bin subdirectory and then: cp -p /cdrom/devbin-s2/* /mnt/tivo/hack/bin/
That will copy over all the essential binary commands we will need to use the BASH shell. Now all we have to do is create the “hackinit” file to call our BASH shell. Do this by typing the following; Hitting ENTER after each line:
(Note: be very careful to get it 100% perfect or it may not work – Be ESPECIALLY sure to get the case right in ttyS2!) cat >/mnt/tivo/hack/hackinit #!/bin/bash date>>/var/hack/hackinit.log PATH=/var/hack/bin:/sbin:/bin:/tivobin:. /bin/bash</dev/ttyS2&>/dev/ttyS2&
Once you hit ENTER on the last line, press CTRL+D to close the file. DOUBLE-CHECK your work, because if even one character is wrong, it will not work! If you realize you made a mistake, begin again at the “cat”. Once you have verified, we need to make it and the other commands executable by doing this: chmod -R 777 /mnt/tivo/hack
Which completes that, now all that remains to be done is the boot page “hook”.....
16. Ok this is the final modification, we hook the code in the Last Partition (determined in Step 12) by typing this VERY CAREFULLY:
(Note: The blue XX should be replaced with the blank partition number determined in step 12!) bootpage -P "root=/dev/hda7 BASH_ENV=\`mount\$IFS-n\$IFS/dev/hdaXX\$IFS/mnt;echo\$IFS/mnt/hacks\`" -C /dev/hdc
Make 100% sure you get the case proper, and be VERY careful to make the “reverse single quotes” properly. Most people mess this up. There are 2 in the line, each one is preceded by a backslash (\) and is usually made by pressing the key near the upper-left of your keyboard (on the same key as the ~). If you don’t get this correct, this will all fail, So triple-check the line before hitting enter! Once this command completes, you are ready to unmount the TiVo drive with the “Three-finger salute” (CTRL-ALT-DEL), wait for the PC to reboot, then power it down and move the TiVo drive back to it’s home!
17. Ok, here is the Final step, if all goes well, you should have a BASH prompt! Connect your new serial cable to the Serial port on your PC, and open a standard VT-100 type terminal communication package such as HYPERTERM or MINICOM, being sure to set the PC’s port to 9600-8-N-1. Test the setup by using something metal to short the first 2 contacts (the small tip and little ring after it) on the 1/8” plug on the other end of the cable. When you type on the PC, and that bridge is in place on the 1/8” connector, you should see all the characters “come back” (echo) to you. If you don’t, troubleshoot your COM port setup, and/or cabling. Now plug the 1/8” plug into the back of the TiVo where it is labeled “Serial”. Restore power to the TiVo and watch the PC. Right before the TiVo changes from “Welcome. Powering up..” to “Almost There” you should see this: bash: no job control in this shell
Now you should be able to “move around” in your TiVo. Be careful not to invoke any commands that do not auto-terminate, as there is no job control on this shell! (Can’t CTRL+C to stop them).
CONGRATULATIONS, You are a TiVo Hacker! =)
My next “installment” to this section will be how to add the USB Ethernet support. I have to go out and get one of those 3-Com USB Ethernet adapters, first! Once I get that done, I will try and add a TivoWEB “How-to” for the HDVR2.
If you are going to “experiment”, it might be a good idea to go backup your TiVo drive again first. Use the same procedure as outlined in steps 8-10, except I recommend you choose another file name instead of tivo-2.bak. Maybe hacked-2.bak instead. (if you have the space). Then you can play around and learn without fear of really hurting anything. You also have the option of the “original” TiVo drive if you took my advice. ;-)
Also note that you can only modify stuff in /var. Everything else is mounted Read-only by the TiVo. Besides, even if you did, since we are running an unmodified system, the TiVo would do away with any changes at boot time.