//depot/projects/tivo/README.hacks#3 – edit change 25 (text) ·revision history
| 1 | TiVo Series 1 hacking notes -- packetrat |
| 2 | ========================================= |
| 3 | |
| 4 | Unit: Philips HDR312 (Series 1, 30hr), software 2.5 |
| 5 | Status: hacked, bash over serial AND telnet (TurboNet!) |
| 6 | |
| 7 | What I did |
| 8 | ---------- |
| 9 | 1. Pulled the A drive (Quantum 30GB), stuck it in the linux box as /dev/hdc. |
| 10 | Do NOT let windows touch it. Windows will offer to "initialize" it. |
| 11 | Say no. Say no very firmly. |
| 12 | 2. Booted the TiVo hacking CD (mfstools boot disk). |
| 13 | 3. Backup first! |
| 14 | mfsbackup -6so - /dev/hdc | gzip -9 > tivo-a.mfs.gz |
| 15 | 4. Set bootpage to drop to bash: |
| 16 | bootpage -p /dev/hdc # find active root (hda4 or hda7) |
| 17 | bootpage -P "root=/dev/hda7 BASH_ENV=/etc/rc.d/rc.sysinit.author" -C /dev/hdc |
| 18 | 5. Copied rc.sysinit.author into /etc/rc.d on the active root. chmod 755. |
| 19 | 6. Serial cable: 3.5mm stereo plug -> DB9, 9600 8N1. |
| 20 | 7. TurboNet card in the slot. eth0 is 192.168.1.42. |
| 21 | telnet 192.168.1.42 / ftp 192.168.1.42 (tivoftpd, anonymous) |
| 22 | |
| 23 | Phoning home |
| 24 | ------------ |
| 25 | Set the dial prefix to ",#401" so it fakes a successful call. Works |
| 26 | for guide data over the serial PPP hack, but it STILL picks up the |
| 27 | phone line at 2am. Roommate is not amused. |
| 28 | |
| 29 | TODO |
| 30 | ---- |
| 31 | - figure out why it still dials home at 2am |