Updated August 6, 2002 - An updated version of these instructions are now included of my TiVo Newbie Hacker Guide at:

http://tivo.stevejenkins.com/

I didn't start to hack my TiVo until after my 3.0 software was installed. So in response to some posts I've seen in here, I've written these steps for first-timers to gain telnet access to their 3.0 systems if they never had any prior shell access. Please use at your own risk.

These steps assume the following conditions:

- You did not previously have shell access to your TiVo.
- You are currently running version 3.0 TiVo software on a Series I TiVo.
- You have an Ethernet adapter installed in your TiVo, such as TiVoNET, TurboNET, etc., that is functioning (you can ping your TiVo from another computer on your network).

These instructions are largely based on the TiVo Hacking FAQ sections 4.6 and 2.15, some posts in the TiVo Underground Forum, and my own experience setting this up with a Sony SVR 2000 and TurboNET Ethernet adapter.

You will need the following for this procedure:
- A PC with IDE hard drive connectors
- 2 blank 3.5” floppies
- A TiVo (duh!)

1. Print out these instructions now so you will have them to reference when you’re not in front of a Web browser.

2. Start by downloading the following two files:
a. Dylan's Boot Disk
b. QUNLOCK.EXE

3. Follow the instructions in Dylan’s README file to build a Linux Boot Disk. If you are running Windows (95/98/ME/XP/NT/2000), this is done by simply inserting your blank 3.5” floppy into your Drive A: and running the MAKEBOOT.BAT file.

4. Using your second floppy, make a DOS boot disk and copy the QUNLOCK.EXE program to it.

5. Power down both your PC and your TiVo. Remove your TiVo cover using a Torx 10 screwdriver to remove the screw and slide the cover off the unit. Don’t pry! If you have trouble, put your TiVo on the ground and use a gentle “kick” on the top edges to slide the cover toward the rear of the unit. Congrats! You just voided your warranty!

6. Carefully remove your primary TiVo drive (called the A Drive). It’s jumpers are currently set to make it an IDE Master (as opposed to a Slave) so to make things easy, let’s keep it as a master when we install it in your desktop PC in the next step. But to do so, it must be installed on IDE Channel 2. I’ve been told that this procedure won’t work if you install it in your PC the IDE Channel 1 Master. This process will work if it’s the IDE 1 or 2 Slave, but you’ll have to change jumper settings now, and then back when you put it back in your TiVo. So to make things easy, just keep is as master and we’ll install it on IDE 2 Channel 2.

7. Unplug the IDE cable and power cable from whatever device is in installed in your PC as the IDE Channel 2 Master. You can find out the IDE channel by looking at the markings on your motherboard next to the IDE connectors, and the Master will be the device that is connected to the first connector as you move away from where the cord plugs into the motherboard. There’s a good chance this device will be your PC’s main hard drive.

8. Plug the IDE Channel 2 Master connector and the power cable into your TiVo A Drive. If you’ve got the IDE connector installed the wrong way, you’ll find out soon enough in a subsequent step. Just power down and swap the connector and start over from this step.

9. Insert your Linux Boot Disk into your PC and power it up.

10. If all goes well, your system will boot into Linux. Watch all the messages on the screen as they fly by. Near the end, Linux will attempt to connect to all your IDE devices. It will most likely name your floppy drive something like “FD0” and it will name the drive you installed as the IDE Channel 2 Master something like “HDC.” After it names your drives, it will tell you how megabytes it sees on the disk (while Linux loads you’ll have time to locate this number.) MAKE SURE THIS NUMBER MATCHES THE SIZE OF YOUR TIVO A DRIVE. If it is low (such as 9-10MB), then your drive is locked. Follow step 11 ONLY if your drive is locked. If it isn’t, skip ahead to step 12.

11. USE THIS STEP ONLY IF YOUR DRIVE IS LOCKED! To unlock your drive and allow Linux to access it properly, power down your PC, insert the DOS boot disk with QUNLOCK.EXE on it, and restart your machine. It will boot to a DOS prompt. Enter the following (without the quotes): “QUNLOCK 2” and hit ENTER. This will unlock the IDE Channel 2 Master. If you installed the disk on a different IDE Channel or as a slave, just run QUNLOCK to see the correct number to run to unlock your drive. Power down your PC, re-insert the Linux boot disk, and boot into Linux. Watch carefully to make sure your drive size is properly reported. If it’s not, then something went wrong with the unlock process. You either entered the wrong number as the option, or you didn’t power down to allow the drive to power up in an unlocked state. For more info about locked drives, check out section 2.15 of the FAQ.

12. When Linux is done booting, you will see a login prompt. Type in “root” (no quotes) and hit ENTER.

13. You will need to “mount” your drive so that you can edit the necessary files. The first file you need to edit is on Partition 4. To mount this, type:

mount /dev/hdc4 /mnt

The “c” in the above example means it’s the IDE Channel 2 Master. If you have yours set up differently, then refer to Section 4.6 of the FAQ for the correct letter to use.

14. Type “joe /mnt/etc/rc.d/rc.sysinit” (without the quotes) and hit Enter. This will open the joe editor and load the file that TiVo looks at when it first boots up.

15. Page down to the bottom of the file add the following on a line all by itself:

tnlited 23 /bin/bash -login &

16. Save the file by typing CTRL-K followed by CTRL-X. You should get a message that the file was saved.

17. Type “umount /mnt” and hit ENTER to unmount Partition 4.

18. Now you need to make the same change on Partition 7, which stores an exact copy of the startup files. Type “mount /dev/hdc7 /mnt” (no quotes) and hit ENTER. Then repeat steps 14 – 17 to edit the startup file on this partition.

19. When you’re done making changes, type “exit” and hit ENTER to log out of Linux.

20. Power down your PC, remove the TiVo A Drive, and re-install it in your TiVo.

21. Power up your TiVo, wait for it to boot, and then telnet to the IP address of your TiVo. You should see a bash shell prompt! You’re in! Hack away!

Like I said, I'm kind of a newbie myself, so if you have any questions, post them here and I'll try to answer. But more likely, someone who really knows what they are talking about will probably answer better

Oh - and check the FAQ. Everything in here is based on stuff I learned in there and browsing through the forums.

Good luck, and happy hacking!

Steve Jenkins

P.S. Did I mention your should check the FAQ?

What about if I have a 2 drive setup.. do I need to pull both drives to do this?

Thanks stevejenkins. These are the types of guides we need to see in the underground again.

Nope.

Thanks for the step-by-step instructions. It could not have came at a better time!

Cheers!

-Dave

Steve,

Great instructions on getting telnet up and running. Would you mind if I mirror them on a tivo help page I'm working on?

By the way, I frequently used and thoroughly enjoyed the Windows95.com site when you were at the helm.

-Carlton

[scratching my head]

Are you the Steve Jenkins that ran the Windows95.com download site? If so, that was one nice piece of work! At one time, I used that site about every week. :-)

You were way ahead of your time on the design of that site... Anyway... I'll avoid going further off topic. My apologies to the group. I just had to say nice work to Steve.

Cheers,

-Dave

Carlton and Daverx7: Yes - I'm the same Steve Jenkins who used to run Windows95.com (and then later WinFiles.com). Wow - I'm honored that anyone would still remember. Thank you!!!!!

Last year I started a new site at http://www.cheatcodes.com/ for video game players. We're trying to follow a lot of the same principles as Windows95.com, and it's nice to be publishing live on the Web again after being out of the game for a couple of years (due to a non-compete I signed when I sold the site to CNET).

Anyone is welcome to use the instructions in this thread for any FAQs, sites, etc. (edited as necessary for their application) or any other instructions I post in the Underground (and I hope to post more), as long as they give proper credit to me and the Underground Forum as the source.

I think a site that contains lots of specific step-by-step instructions for TiVo Hacks is a great idea. I love the Underground Forum. It's the best online location for TiVo Hacker discussions. And because of this, it's packed with SO much great information that it's sometimes a bit overwhelming to wade through it all when just getting started. New users LOVE step-by-step instructions (that's actually how Windows95.com started - with step-by-step instructions for getting Windows networking stuff to work over the 'Net).

Such a site would also reduce a lot of the repetitive "how do I...." posts in here, and would allow more focus on leading-edge TiVo hacking discussion.

Steve

I did follow the instruction step bu step but "joe" does not found the rc.sysint file on partition 4. I have a Tivo Series 2.

Thx


yannco

Well, I see that the instruction is for Series 1.
I guess, it's no go for series 2.

Oh, well. I will have to wait I guess.


yannco

It might be a good idea to make a backup of the rc.sysint file before editing it with Joe. Anyone know the exact linux command line to create a backup?

Duke

Duke:

That's never a bad idea. Do it like this:

cp rc.sysinit rc.sysinit.bak

If you hose up the rc.sysinit file for any reason, you can restore the original rc.sysinit by typing:

cp rc.sysinit.bak rc.sysinit

Steve

Thanks, Steve. BTW - loved your windows95.com site. It was on my list of "must haves".

Duke

Hello:

In order to enable telnet & get back the utils I was accustomed to after my Tivo was upgraded to 3.0, I modified the CWorley Tivonet script.

I removed the portions that copies over the Tivonet drivers, and removed all the lines with the exception of the one required to enable telnet in rc.sysinit.

I have attached the scripts to this post which include 3 scripts, 1 which performs the script on both partitions, and the other 2 only perform the script on 1 partition. I have posted them on a webpage as well http://www.jsprod.net/tivo30script.htm with instructions.

I don't know if anyone else will use this, but it worked for me.

Thanks,

John

I wanted to ask some advice on this before I attempted some deep voodoo.

I had my TiVoNet installed back around 2.0 and didn't ever bother to redo the hacks when my TiVo updated to 2.5. Now that 3.0 is out, I wanted to do it again.

Obviously I can't boot off of my 2.5 partition since I never "hacked" that version of the software...

But as a longtime user of linux and small-time kernel hacker, I had to wonder -- why can't we run a bash on the serial port by passing an init= option to the kernel via the bootloader? Most late versions of bash support running in place of init. Does the one on the TiVo? Has anyone tried this approach? Does the kernel support a serial console (IE CONFIG_SERIAL_CONSOLE)?

The idea would be to boot the kernel with serial port bash as the init, mount /proc and remount root rw (or have the kernel mount it rw instead), insert the lines to fire up the serial port shell into rc.sysinit (and/or the telnetd in rc.net) then reboot and change the boot parameters back.

Any thoughts on this? I am not sure that you can pass a command line to the init on the kernel commandline (though I haven't ever needed to), so if that is indeed the case, the plan is foiled there unless the kernel supports a serial console ...

Any ideas? Can anyone who is intimate with the TiVo boot process please warn me if even trying this is going to some how blow my TiVo away?

Thanks,
John

Hmmm..... that's an interesting idea, but a bit above my hack level of expertise. Do you not want to open your unit because you don't want to void the warranty? Or are you just looking for a new and challenging hack?

Otherwise, I'd say make a backup of your drive and give the hack a whirl. It could be a great discovery if it works.

Of course, you'd have to open your unit to back up your drive... and then at that point, you may as well yank the drive and mount it with Kaz's CD and start hacking that way anyway

Let us know what you find!!!

Has anybody tried to do something similar from a Power Mac running OS X? It's already a Unix OS...

Steve:

Well, It'd be pretty good for those folks who don't want to void their warranty (I voided mine years ago .. I was just curious about it. It's more of a pain to hook the drive up to another machine than it is to take it out of the tivo.

I went ahead and opened up the tivo last night to do another mod (callerid enabling for the SA's internal modem), so i didn't really fool with my idea, but I imagine it's sound. I'll probably try it sometime, since the only thing that can happen when changing the init to /bin/bash is ... the tivo will boot normally or the tivo will boot to bash!

jsnell:

While OSX and macintosh are going to be able to support the partition table of a TiVo drive, they may have endianness issues which I don't believe the OS/X kernel lets you twiddle. In addition, I don't know of any ext2 filesystem support for OS/X, so you probably wouldn't be able to edit files on those partitions or anything.

If you were to run a linux kernel on your mac with the necessary patches to allow you to byteswap in case you needed it and recognize the partition tables, you could definately edit, transfer, etc files on the tivo drives with a mac. I dont know if the sources for mfstools are available, but they'd have to be compiled for Linux/PPC before they'd work (and they probably have horrible endianness issues, being as they're supposed to be run on a byteswapped drive on x86)

All in all, if the drive endianness is correct for your macintosh ppc system, and you had somehow a Linux/PPC copy of mfstools, I'd imagine your backups and upgrades would go about 50 times faster than they do on x86. All in all, if you are not a terribly skilled Linux, TiVo, and PPC hacker, you probably ought to find a buddy with an x86 box I don't know if others have already gotten any of this working. Any mac tivo hackers out there?

Just a note on the jumpers. If you have a western digital drive to make it master if it is the only drive on the cable you probably need to remove the jumper instead of leaving it in the master position.

Got mine setup today using mostly this and the boot cd. Someone should put in big bold letters somewhere when you boot to use vmlinuz hdx=bswap at the boot prompt were hdx is the drive you have the tivo drive connected to. After figuring that out from the FAQ it was all pie. Now to figure out were all those shell utilities went to.

thanks for posting a detailed HOWTO...

... but i didn't understand why do you
want people to open the Tivo, remove
the harddrive and edit that file from LINUX
on a PC, rather than logging in on the TiVo
via the SERIAL interface and modify the
file on the running TiVo instead???

As far as I can see, removing the harddrive
is not necessary for editing this file.. no??

I used the serial interface on my TiVo, with
an older version of the TiVo kernel (2.0).. and
didn't use it in quite a while..

just found the pointer on how to re-gaining shell access
on the serial line without opening your TiVo

http://www.tivocommunity.com/tivo-v...8&highlight=3.0

hope that helps some people.

I can answer that one!

Because with TivoNet & TivoWeb and 2.5, I telnet in over the network using an IP address. I did away with the BASH prompt at the serial port (slower than IP) in favor of using the serial port to control the channel changing on my satellite system (more reliable than the infrared blaster.)

Besides, it makes sense to backup your newly upgraded software at the same time, while you have your drives out of the TiVo, for obvious reasons. Can you ever have too many backups?

Potentially dumb question here... I'm stuck right at the beginning where I need to mount the partition. It wont let me do it because it says I need to specify the filesystem type. I'm sure the drive isn't locked because I upgraded this thing awhile ago but I did just do a fresh restore to 3.0 today. When it's all plugged in, the tivo works fine, reads 88 hours and gets its updates from the ethernet...

I'm really baffled as to why this wont let me mount this drive/partition, I'm busy scouring the pages and forums to try to figure out why but I figured that asking for a little help wouldn't hurt either.

Thanks much.

Junon:

I just answered this over on:

http://www.tivocommunity.com/tivo-v...=&postid=591427

You'll kick yourself and do a Homer-style "doh!" when you read the solution, but it's not THAT dumb of a question, and you're not the only person to make this mistake, so don't sweat it

Okay, I can be pretty dumb but I don't think that's the problem I'm having. I know that it's hda when it's in the tivo but so far I haven't had to deal with that directly. When I put it in my machine it is hdc and no matter what I do, what boot disk, weather I use a script or do the commands manually, it still comes down to something about not specifying the filesystem type. I tried a different boot disk this last time and this time it said (and I'm gonna type this by hand, so bear with any mistakes...)

(none) login: root
# mount /dev/hdc4 /mnt
fatfs: bogus cluster size
VFS: Can't find a valid MSDOS filesystem on dev 16:04.
fatfs: bogus cluster size
VFS: Can't find a valid MSDOS filesystem on dev 16:04.
mount: you must specify the filesystem type
# mkdir /flop
# mkdir /mnt4
# mkdir /mnt7
# mkdir /mnt9
# mount /dev/fd0 /flop
# mount /dev/hdc4
mount: can't find /dev/hdc4 in /etc/fstab or /etc/mtab

Now in all fairness, I have not read your entire guide yet but I've been in and out of these tivo bootdisks and whatnot more than a few times over the last half a year so I'm casually aquainted with the processes involved... I don't think I'm messing anything up but it certainly wouldn't suprise me. I try and do my research though.

By the way, I was a big fan of windows95 and winfiles back in the day. Good job with that... memories...

Here's a vexing problem I just can't seem to figure out, and I'd appreciate some advice. I have a Sony SVR2000 with 3.0, and I just installed my turbonet card. I got the machine to successfully make its' test call via ethernet. I then removed the drive to enable telnet access. I used joe to edit the rc.sysinit files on both partitions 4 and 7, and then put the drive back in my TiVo.
After the TiVo booted, everything seemed fine, except I still had no telnet access. So, I took the drive back out and looked at the rc.sysinit files. Strangely enough, the rc.sysinit file on partition 4 lost the line I added at the end to enable telnet access. The file on partition 7 still had my edits in it. So, I edited the file on partition 4 again and saved it. Again I booted the TiVo to find that I had no telnet access. I took the drive back out and looked at the file on partition 4. For a second time, my edits were no longer present in the file.
Is there some kind of file protection mechanism on the series I TiVos in 3.0? Does anyone else know what might be going on here? Any help is greatly appreciated...

Manex:

Turbonet/TiVoNet support is now built-in to the 3.0 software. You need to add a prefix to your dialing preferences to enable it. See this link. If you've done that, you then need to obtain or assign an IP address for your TiVo. My LinkSys router uses DHCP so I just read the DHCP Client Table to see the dynamic IP address that is assigned to my TiVo. Then just point your telnet/ftp/web browser to that address and away you go...no editing necessary. I'm sure this is explained in more detail elsewhere in this forum...you may need to do some digging.

Junon:

From what you have written, it appears you are trying to access the TiVo drive as a vfat (or MSDOS) filesystem, which doesn't make a lot of sense to this Linux newbie. I think you may have fallen into the same trap that I did...the bootdisk (actually, the CD-ROM) that I used evidently only allows one non-byte-swapped drive, so I had a devil of a time accessing my second MSDOS drive as hdb. Ultimately, I disconnected it and my TiVo drive became hdb. You might try using only one MSDOS drive as hda, then follow the instructions...it worked perfectly for me!

I am about to start hacking away this weekend. I got my turbonet installed and enabled it. Works fine making the daily calls. I have already upgraded my tivo, and plan to backup both drives using MFSTools (I hear it backs up just the settings and software, not the recordings. This is a good thing).

A couple of questions about Steve's procedure, which looks very easy to follow, by the way.

First, I notice toward the end, you discuss read-write mounting the 4 and 7 partitions if you want to change the rc.sysinit (or whatever it is called) file. However, way up in the instructions, we modify that file to enable the telnet access, and there is no mention of mounting the drive for write access. Is there a step out of place here?

Second, someone else posted a message in this thread that you have to type vmlinuz hdx=bswap where x is the hard drive of your tivo. What is this all about? I'm worried now since I can't find this anywhere else.

Thanks.
-Josh

Josh:

The reason you don't need to mount your drive with write permissions in the earlier step is because at that point in the process, your TiVo's hard drive is in your PC, mounted using the boot disk, and nothing in the OS from the boot disk marks the partition as read-only.

Once you put the drive in your TiVo, the TiVo OS sets those partitions as read-only, which requires the remount with write permissions.

As far as the vmlinuz hdx=bswap stuff goes, I never needed that with my setup. I think that only comes into play if you have other hard drives that you keep connected in your PC when you try to mount your TiVo drive. If you follow the guide completely, which suggests you remove all other hard drives from your PC to avoid such problems, you'll be golden.

Best luck with your hack. Let me know how it goes!