Erik's TiVO Page

for the Hughes DVR2 (MIPS)

TiVO

Weaknees.com

Enabling 30 Second Skip

Steve's TiVO Page (S1 & S2)
Twin Brothers (S1 & S2)

TiVO Utils Goes to SourceForge.net!

Steve has setup a SourceForge project for the TiVO utils! Check it out at tivoutils.sourceforge.net.

DISCLAIMER

As a Hughes DVR2 (Series 2) TiVO owner and hacking enuthasiast I've gathered a respository of tools and binaries for the HDVR2 that are specific for ONLY that model. DO NOT USE THESE IN ANY OTHER MODEL TiVO!

You have been warned!

5/6/2003 8:53PM::The Inital Hack. What I "did".

You got TiVO and now you want to hack it? This is a condensed version of most TiVO hacking pages. More or less it is a journal of what happened to me.
I started out with a standard 35 hour Hughes HDVR2 (A Series 2 DirecTV TiVO). I then purchased a expansion kit from Weaknees.com. It contained a second drive (80GB) a mounting bracket and some fans as well as the all-mighty TORX #10. (Later I learned that my swiss army knife had a torx 10. Much suffering could have been averted had I known).

Step 1. Before powering up, I installed my second drive with the expert guidance of the Weaknees instructions.

Step 2. After completing this I powered it up and registered with DirectTV.

Step 3. After registering (and waiting 24-48 hours to get the guide) I entered in all the thumbs up/down, todo list and favorites I wanted. I then had the drive backed up. You will need a computer with at least a couple hundred megs free on a FAT/FAT32 partition that is accessable from the Linux based "Joe Black" MFS Tools Bootable CD (iso here). I followed the following instructions from a message board and backup the drive to the FAT/FAT32 partition..

Step 4. Follow this description of how to get bash. As a HDVR2 with a second drive already installed there were some steps I had to skip.

Step 5. Once bash is had, and the tivo "hacked" then you can download anything to it via the "http_get" executable. Here is a proper command line execute of this program:

    $ http_get -t 180 -D /var/hack -T 0 -C 0 -U $URL -sd

Simply replace the "$URL" part with the http://URL of the file. This will place it in the /var/hack folder (this was created during the hack.)

...to be continued...

5/6/2003 10:29PM::TiVOWeb

This is a utility which allows you to control your tivo through a web broswer.

    Step 1.) Download from TiVOWeb
    Step 2.) Install in /var/hack/tivoweb-tcl
    Step 3.) Install MIPS specific binaries (from here)
    Step 4.) chmod 755 bsearch get_space *.tcl *.itcl
    Step 5.) Modify httpd-tt.tcl to add "151" to line 637 (checks version info)
    Step 6.) Modify httpd-tt.tcl to remove ":[base64enc]" on line 656
    Step 7.) $ /var/hack/tivoweb-tcl/tivoweb console
    Step 8.) Connect to your TiVO.

5/6/2003 8:43PM::kmem

KMEM is a linux executable that modifies the actual kernel code that is sitting in memory.

For the love of Galt, DO NOT PLAY AROUND WITH THIS!!!

    Instructions:
    ====================================================
    Place kmem in your /var/hack/bin. Make it executable with

    $ chmod 777 /var/hack/bin/kmem

    Place the following in your hackinit file:
    ./kmem 800b23b4 00001021

This allows you to record the shows UNENCODED. This means programs like MPlayer can then re-play the shows afterwards. If you didn't do this then MPlayer wouldn't be able to read a ty stream from your TiVO. The caveat is that any shows you had sitting on your HDD when you enabled this are now un-watchable (until you reverse the setting and reboot).

Mirror of Steve's TiVO Page

TCL Scripts
seasonpass.tcl	3KB	Simple TCL script to print out Season Pass items, updated to work on 3.x systems
thumbdata.tcl	2KB	Simple TCL script to list, dump, and import Thumb Data on a TiVo.
suggestions.tcl	2KB	Simple TCL script to print out TiVo's Suggestions
todolist.tcl	2KB	Simple TCL script to print out ToDo List items
TiVo Digital Cable Remap Channels.tcl	2KB	For digital cable users, this script will create a new lineup (typically on the rf input). This will allow you to tune all "analog" stations through the RF input, and the digital stations through Svideo/RCA. This dramatically speeds up channel changes. After creating the new input, this script will cycle through all of your stations, prompting you if you want to move the station to the new input (i.e. answer yes to all of your analog stations).
Misc Stuff
TiVo Patents	link	Link to USPTO search on TiVo patents.
bootpage.tgz	6KB	Source & i386-linux binary for a simple utility to modify the bootpage of a TiVo drive. Sample usage: To retrieve the current bootparameters, execute: bootpage -p /dev/hdX . To change the bootparameters, execute: bootpage -P "newbootparameters" -C /dev/hdX (w/o -C nothing will be written to the drive). Note: The code is ugly (I blame that on two years of working in a Java shop), but functional.
extract-gzip.c	2.2KB	C source to extract gzip files from within files. Useful for extracting the initrd image from a kernel image.
dumpmem.c	2KB	C source for my dumpmem program, inspired by /diag/dumpmem on my S2 (although mine is not nearly as elegant). Specify a memory-offset and a length, and this will dump the contents in a "pretty" hexdump format. For example, on a S2 to view the first 100 bytes of the PROM, you'd do: *dumpmem 0x1fc00000 100. Or if you compile this on a x86 box, and view the first 100 bytes of your video card: dumpmem 0xc0000 100*. Note: Standard disclaimers apply, as well as the usual "the code is ugly, I work in a Java shop, blahblahblah" spiel.
tivo-hacked.html	24KB	Mirror of cracked tivo.com, 9:30AM (MST) 06/11/01. Not that I condone cracking, but this is some damn fine ascii art :)
Restoring a TiVo from "source files" backup.	48KB	Local copy of d18c7db's Restoring a TiVo from "source files" backup.
Upgrading w/Slice Files	6KB	Provided here for those TiVo owners outside of the US/UK, whom wish to perform a software upgrade using slice files. Not particularly useful for US/UK folks, since this happens automatically for you. And nothing terribly earth shattering, as you could've figured this out by reading through /tvlib/tcl/updateSoftware.tcl .
Series 1 Stuff
tivobin.tar.bz2	12.2MB	x86 cross compiler for Series1
native_compiler_tivo.tar.gz Mirrors: 2150.com	32MB	Native Compiler for Series 1. Instructions are here.
usr.local.tivo.dmg Mirrors: 2150.com	14.3MB	Series1 Cross Compiler for Mac OS X. i.e. Only useful for those of you with a Mac OS X machine to install this on.
pdisk-s1.gz	27KB	pdisk compiled for S1. This version won't trash the bootpage like the other pdisk binary floating around.
thermpatcher.gz	8.8KB	Utility to patch in new therm values in the /tvbin/fancontrol application. Quick usage follows: Mount / read-write (mount -o rw,remount /) Execute thermpatcher (thermpatcher -T 75 -c 70 -l 65 -t 48 -i /tvbin/fancontrol -o /tvbin/fancontrol.new) Move current fancontrol to a 'backup' location (mv /tvbin/fancontrol /tvbin/fancontrol.old) Move new fancontrol into place (mv /tvbin/fancontrol.new /tvbin/fancontrol) Make sure /tvbin/fancontrol is executable (chmod a+rx /tvbin/fancontrol) Remount / readonly (mount -o ro,remount /) Reboot the machine At this point, your new therm values should be in effect.
smartctl.gz	31KB	Initial port of smartmontool's smartctl to Series1 units. This should be completely functional with the exception it will not print out the SMART Error and Self-Test Logs. That defect is currently being investigated.
unzip-s1.gz	52KB	Somebody in #tivo asked for it, so here it is - unzip precompiled for S1.
less-378-s1.tar.gz	68KB	Yet another request in #tivo -- less 378 precompiled for S1/powerpc. Extract the archive, and then add /var/hack/lib to your LD_LIBRARY_PATH (i.e. export LD_LIBRARY_PATH=$LD_LIBRARY_PATH:/var/hack/lib). Includes libtermcap
tnlited-nofork-s1.tgz	12KB	Modified version tnlited so it doesn't fork, and a wrapper script that'll "respawn" tnlited if the process dies. In your startup file, instead of calling: /sbin/tnlited 23 /bin/bash -login & Instead call: /var/hack/bin/tnlited.sh & If you want to change the port number, modify the /var/hack/bin/tnlited.sh file. Somebody in #tivo asked for a way to "respawn" tnlited, so here it is (albeit a cheap hack). Precompiled binary for S1/powerpc.
tivoftpd.ppc.gz	18KB	sorphin's tivoftpd v0.2 for Series 1/PowerPC. Binary only.
Series 2 Stuff
usr.local.tivo-mips.tgz Mirrors: algonet.se, 2150.com	55mb	Complete Linux-i386 cross-compilation environment for Series 2 MIPS. binutils-2.11 , gcc-3.0, glibc-2.2.3. Langauges included are C and C++ (No objc or gcj). Suitable for making S2 binaries.
build_mips_x_compiler.sh Mirrors: alt.org	3KB	Script used to build the above package. Note: This has only been tested on a Slackware 8.0 system with gcc-3.2. Please let me know if this works or not for you.
devbin-s2.tgz	320KB	Precompiled S2 binaries of: chgrp, chown, chroot, cksum, comm, csplit, cut, dir, dircolors, expand, false, fmt, fold, groups, head, hexdump, hostname, id, install, join, logname, ls, md5sum, mkfifo, mknod, more, nl, nohup, od, paste, pathchk, pr, rmdir, split, su, sum, tac, tail, tar, tee, touch, tr, true, tty, unexpand, uniq, uptime, vdir, wc.
netbin-s2.tgz	660KB	Precompiled S2 binaries of: arp, netstat, ping, rarp
tivoftpd.mips.gz	15KB	sorphin's tivoftpd v0.2 for Series 2/MIPS. Binary only.
busybox-0.60.5-s2.tgz	130KB	Precompiled busybox v0.60.5.
elvis-2.1_4-s2.tgz	200KB	elvis 2.1_4 precompiled for S2 MIPS.
epic4-1.0-s2.gz	250KB	epic4-1.0 precompiled for S2. Why is this here? Something about irc'ing from a mips based TiVo seemed like it would be good for a laugh. Note: If you get a server message about an illegal username, type /ircuser <username> and then try reconnecting.
ps-s2.gz	230KB	ps precompiled for S2.
strace.gz	92KB	strace precompiled for S2.
less-s2.gz	61KB	less precompiled for S2.
wget-1.8.2-s2.tar.gz	340KB	wget v1.8.2 precompiled for S2.
unzip-s2.gz	50KB	unzip precompiled for S2.
joe-2.9.8-pre1-s2.tgz	310KB	joe-2.9.8-pre1 precompiled for S2.
pdisk-s2.gz	26KB	pdisk precompiled for S2. Based on sources from http://tivohack.sourceforge.net
vim61-s2.tgz	560KB	vim v6.1 precompiled for S2. Add export LD_LIBRARY_PATH=$LD_LIBRARY_PATH:/var/hack/lib to your profile or such.
netcat-s2.gz	10KB	netcat precompiled for S2
rsync.gz	85KB	rsync precompiled for S2
s2-2.4.18-modules.tgz	395KB	Package contains the following modules for Linux kernel 2.4.18 (i.e. TiVo v4.0): acm.o af_packet.o cdrom.o dc2xx.o hid.o input.o isofs.o kaweth.o keybdev.o keyspan_pda.o lockd.o loop.o mousedev.o nfs.o pcnet32.o pegasus.o rio500.o rtl8150.o scsi_mod.o sd_mod.o sr_mod.o sunrpc.o usb-ohci.o usb-storage.o usbcore.o usbserial.o
s2-2.4.4-modules.tgz Mirrors: alt.org	380KB	Package contains the following modules for Linux kernel 2.4.4 (i.e. TiVo v3.0, v3.1.0, v3.2): acm.o af_packet.o cdrom.o dc2xx.o hid.o input.o isofs.o kaweth.o keybdev.o keyspan_pda.o lockd.o loop.o mousedev.o nfs.o pcnet32.o pegasus.o rio500.o rtl8150.o scsi_mod.o sd_mod.o sr_mod.o sunrpc.o usb-ohci.o usb-storage.o usbcore.o usbserial.o
killinitrd-s2-v3.x.gz killinitrd-s2-v4.0.gz	1.9KB 1.9KB	x86 binaries of killinitrd for Series2 kernels. This will patch the four locations that would normally call panic("No bootable RAMdisk"), instead having them return normally. This will also nuke the gzip magic on the initrd image, effectively disabling initrd on S2 units. Two binaries are provided, one that has been tested against v3.1.0 and v3.2 kernels, and another for v4.0 kernels. In order to take advantage of this, you will need to have your PROM patched. If you use these w/o a patched PROM, your unit will not boot. Provided because the current method in the 'scene' for bypassing initrd is utterly pathetic. Source code is available here.
Misc Datasheets / Product Briefs / Manuals
tivo.com/developer	link	Offsite link to TiVo's Home Media Option: Developers page. Contains TiVo Home Media Option: Music and Photos Server Protocol Specification v1.1.0, TiVo Connect Automatic Machine Discovery Protocol Specification v1.5.1, and Example Apache plug-in for Music and Photos v1.1.
S71150.pdf	375KB	SST39VF010 Datasheet (http://www.sst.com/products.xhtml/parallel_flash/39/x8/SST39VF010)
doc0395.pdf	130KB	AT28LV010 Datasheet (http://www.atmel.com/atmel/acrobat/doc0395.pdf)
50906.pdf	230KB	NEC VR5432 Product Brief (09/00) (http://www.necelam.com/docs/files/50906.pdf)
U13504EJ3V0DS00.pdf	145KB	NEC VR5432 Datasheet (08/00) (http://www.necelam.com/docs/files/U13504EJ3V0DS00.pdf)
1375_V1.pdf	2.5mb	NEC VR5432 User's Manual Volume 1 (05/00) (http://www.necelam.com/docs/files/1375_V1.pdf)
1375_V2.pdf	2.9mb	NEC VR5432 User's Manual Volume 2 (05/00) (http://www.necelam.com/docs/files/1375_V2.pdf)
BCM7030.pdf	43KB	Broadcom BCM7030 Product Brief (http://www.broadcom.com/pbs/BCM7030.pdf)
dec-cs22-usrapgd.pdf Mirrors: samba.org	788KB	MPEGCS22 Decoder User's Guide
SAA7114H_1.pdf Mirrors: samba.org	552KB	SAA7114H datasheet (http://www.semiconductors.philips.com/acrobat/datasheets/SAA7114H_1.pdf)
msp34x0g_3pd.pdf Mirrors: samba.org	656KB	MSP 34x0G Preliminary Data Sheet Edition 3PD (http://www.micronas.com/products/documentation/consumer/msp34x0g/ downloads/msp34x0g_3pd.pdf)
msp34x0g_4pd.pdf	1.5MB	MSP 34x0G Preliminary Data Sheet Edition 4PD (http://www.micronas.com/products/documentation/consumer/msp34x0g/ downloads/msp34x0g_4pd.pdf)
PowerPC 403GA-GCX Eval Kit	link	Offsite link to IBM's page for PowerPC 403GA-GCX Evaluation Kits, which contains schematics and other useful information.
0380507.pdf	20KB	Xilinx JTAG/Parallel Port Cable Schematic (http://www.xilinx.com/support/programr/files/0380507.pdf)
DVRSeries2UpdateSpring02.pdf	192KB	TiVo Series 2 v3.0 Service Viewer's Guide Update (http://www.tivo.com/images/manuals/3_0_updateguide/DVRSeries2UpdateSpring02.pdf)
Series2-IG.pdf	1.4MB	TiVo Series 2 Installation Guide (http://www.tivo.com/images/manuals/installguide_series2/Series2-IG.pdf)
Series1VG.pdf	2.5MB	TiVo Series 1 Viewer's Guide (http://www.tivo.com/images/manuals/viewersguide/Series1VG.pdf)
Series2-3.2VG.pdf	2.5MB	TiVo Series 2 v3.2 Viewer's Guide (http://www.tivo.com/images/manuals/viewersguide/Series2-3.2.VG.pdf)

Copyright 2003 Erik Rainey. All trademarks are property of their respective owners. This site and it's contents are provided as is and carry no warranty implicit or otherwise. I'm suprised that your actually reading this part. What? Don't you have a TiVO to hack?