This is merely an outline of how to hack your Series 2 DirecTiVo or stand alone unit. New hacks are literally created every day, so this format will best allow me to easily make any updates as preferred hacking methods change. External links are provided for step-by-step information. You'll notice most of the links will take you to the DealDatabase Forum, which is probably the best source of information for hacking your TiVo.

Introduction
Hacking TiVo's is not for the lighthearted. If you just learned how to turn on your computer a few days ago, you will find this extremely difficult. If you have upgraded your computer's hard drive and know your way around the command prompt, you'll have an easier time of it.

TiVo uses the Linux operating system on a MIPS processor. We will be using the command prompt exclusively. Some Windows commands are the same in Linux, while others are different, but work the same as in Windows. Some Linux experience is very helpful, but not absolutely necessary. There are some subtle differences between Linux running on a PC and the version that runs on the TiVo.

Please realize that by merely opening your TiVo your warranty will be null and void. Before you begin, make sure there is nothing recorded on the Tivo (Now Showing) that you can't live without. Also, write down your Season Passes, Wishlists, one-time recordings (check the To Do list), and any other settings you think you might need in case you toast your TiVo. If you only have one computer and wish to minimize reboots and reconnecting drives, be sure to read through this first, print out the relevant information, and download the necessary files before getting your hands dirty.

USB Network Adapter
In order to access your TiVo from your home network, you'll need to pick up a USB network adapter. A USB 2.0 adapter will typically set you back about $30. The bigger the brand name, the less trouble you'll have getting it to work. Recommended brands include Linksys and D-Link. It's also possible to use a Wi-Fi USB adapter with a few more tweaks that I will NOT cover here.

The TiVo does not have any security whatsoever. Anyone who can get to its IP address will have full access to the filesystem, and can view, record, and delete your shows, Season Passes, etc. Make absolutely certain your TiVo is behind your router's firewall. No external ports should be forwarded to the TiVo's IP address, nor should it be in the DMZ.

The TiVo Replacement Hard Drive
You'll also need a hard drive to replace the original drive in the TiVo. This should be bigger than the original. Yes, you can just hack the original drive, but what if something goes wrong? What if your hacks take longer to apply than expected, and you (or other family members) would just die if you missed your favorite TV show? Large capacity drives are becoming cheaper and cheaper any more, so there really is no excuse to not purchase one. If you have an extra drive lying around that you are planning on using, all existing data will be destroyed.

The Second Drive
Now you'll need a second storage device that will we need to copy files back and forth on the new TiVo drive. It can be another hard drive or a flash memory drive (a.k.a. USB, thumb, jump drive, etc.). If you are planning on backing up your TiVo, it will need to be formatted in FAT or FAT32, and large enough to hold the backup image...2GB is recommended. (Linux cannot write safely to NTFS.) If you are going to simply restore an image, then an NTFS-formatted drive will work too...just keep in mind you will not be able to write to that drive. While it is possible to use flash memory drives, they are often slow and sometimes unreliable. Another hard drive with a small FAT32 partition is really recommended.

On this second drive, you'll need a few downloaded files. Here's how to get them...

1. Download the latest killhdinitrd*.zip file at the end of the first post.
2. You'll need a virgin kernel to apply the killhdinitrd patch. The first post in the link above has information as to which version of the kernel you can use for your particular TiVo, and the second post has information on where you can download them. Download sites frequently appear and disappear. Also check out the Backup image and slice begging thread or do a Google search. The 7.2.2-oth-K1 kernel is probably the most widely use now. Kernels are also available on the DVRupgrade LBA48 CD with MFStools and Enhancements for $5. (This CD image will also come in handy for the next section.)
3. Download tivotools.tar.rar at the end of the first post.
4. Download iptables.
5. Download rc.sysinit.author.

Unzip the killhdinitrd*.zip file and copy the files over to your second drive. Rename the virgin kernel file to vmlinux.px if it isn't already. Copy that over to the second drive. If the kernel file you downloaded ends with a .tar or .gz extension, it is compressed using a Linux compression format. For simplicity, uncompress these files before you copy them over to the secondary drive. I recommend using 7-Zip as it supports all the compression formats listed in this guide.

Extract tivotools.tar from the tivotools.tar.rar file on the second drive. Again, 7-Zip will handle this task flawlessly.

Copy iptables and rc.sysinit.author over to the second drive as well.

Linux Boot CD
You'll also need to burn a CD image that will boot your computer into Linux. Dvrupgrade.com has a free boot disk that will do if you did not purchase the enhanced version mentioned above that works well. There is also the MFSLive Linux Boot CD that automatically detects USB devices. It is also free.

Here is a quick and dirty Linux command line primer...

Linux Command	Equivalent DOS Command
ls	dir /b (displays simple file list)
ls -l	dir (displays file type, permissions, modified date, and size)
ls -a or ls -la	dir /a (displays all files including hidden)
pwd	cd (present working directory)
cd NewWorkingDirectory	cd NewWorkingDirectory
cp OriginalFile Destination	copy OriginalFile Destination
mv File Destination	move File Destination
mv OriginalName NewName	rename OriginalName NewName
mkdir NewDirectoryName	md or mddir NewDirectoryName
rmdir Directory	rd or rmdir Directory

Hinsdale How-To
You should have everything you need now. Let's get our hands dirty! First and foremost, disconnect any drives that you do not need. It is quite possible and easy to wipe out Windows or important data during this process, so it is best not to tempt fate.

Follow the Hinsdale How-To. This is an excellent guide for backing up and restoring the TiVo software to a larger drive. If you using a serial ATA (SATA) hard drive, USB hard drive enclosures, external drives, or flash memory drives, see the next section for some help. Be sure to test that your new hard drive works in your TiVo before continuing. For DirecTiVo owners, you might want to force a few calls because this is the last chance it will have to update itself. Allowing a DirecTiVo to call in after it is hacked is not recommended. If you lose your local channels, check out this tip. If you need or want a clean image of the latest TiVo software for your device, consider purchasing an Instant Cake CD from dvrupgrade.com for $19.99. This CD has a simple wizard that installs the image on your hard drive.

Mounting Drives
We're not done with the Linux boot CD, so don't put it away just yet. Put your TiVo drive back in your PC and boot into Linux with your CD. Unlike Windows, you must mount the hard drive partitions before you can access them. If you followed the Hinsdale How-To, you should be familiar with this, but I will review it.

First you need to create new directories which you will use to access the various drives and their partitions.

mkdir /mnt
mkdir /mnt/dos
mkdir /mnt/hda4
mkdir /mnt/hda7
mkdir /mnt/var           

In the example above, we are creating a mnt directory to mount our hard drive partitions. The /mnt/dos directory is for our FAT or FAT32 partition which will have the files we are going to work with. Then, we create directories for the 4th, 7th, and 9th (var) partitions on the TiVo drive.

Now we need to mount the drives. For hard drives using the IDE/EIDE/Parallel ATA (PATA) interface, Linux refers to it as hdxy where x is a letter (a-z) specifying the drive, and where y is a number (1, 2, 3, etc.) representing a partition on the drive.

hda - first/primary IDE interface, master drive
hdb - first/primary IDE interface, slave drive
hdc - secondary IDE interface, master drive
hdd - secondary IDE interface, slave drive
...

For serial ATA (SATA) or USB hard drive enclosure or flash drive, Linux calls them sdxy where x is a letter (a-z) referring to the drive on a particular SATA interface, and where y is a number (1, 2, 3, etc.) representing a partition on the drive.

So, if I wanted to mount a USB flash drive with a FAT32 partition, I would use the following command:

mount /dev/sda1 /mnt/dos

Now, I need to mount my TiVo drive partitions:

mount /dev/hda4 /mnt/hda4
mount /dev/hda7 /mnt/hda7
mount /dev/hda9 /mnt/var

Don't be too alarmed if you see some messages or warnings. Use the cd and ls -l commands to make sure your drives are configured correctly. If you TiVo has never upgraded itself or you are using a clean image, there may not be anything on hda7. It can be tricky to find and mount the correct serial drive. If you mount the wrong drive, use the umount command to unmount and try again. Example:

umount /mnt/dos

killhdinitrd
Whenever the TiVo starts up, it scrubs the hard drive of files that shouldn't be there. Modified files are replaced with the originals. Obviously, you want your hacks to be there whenever the power goes out. Fortunately, there is a program to kill this hdinitrd process called killhdinitrd.

Copy the vmlinux.px to /mnt/var and run the killhdinitrd program on it. An example follows. It may or may not be the right commands depending on your file names and locations.

cp /mnt/dos/vmlinux.px /mnt/var
/mnt/dos/killhdinitrd /mnt/var/vmlinux.px

Follow the on-screen prompts to patch the kernel file. Once that is done, apply the kernels to the two root partitions...

dd if=/mnt/var/vmlinux.px of=/dev/hda3
dd if=/mnt/var/vmlinux.px of=/dev/hda6

...where /mnt/var/vmlinux.px refers to the patched kernel file.

Prevent Software Upgrades
It is very important to prevent your TiVo from upgrading itself to a new version of the TiVo software. An upgrade will wipe out your hacks, and it is best to upgrade only when you are prepared to do so. Enter this command for your TiVo drive:

bootpage -p /dev/hda

You should get one of two possible responses:

• root=/dev/hda4
• root=/dev/hda7

This tells you which partition the TiVo drive boots from. The TiVo has two root partitions with one being the primary partition. Whenever TiVo downloads and installs a software update, it does so on the alternate partition. If something goes wrong with the software update, the TiVo can still boot up with the other partition. Clever, huh?

If it's hda4, enter this command:

bootpage -P "root=/dev/hda4 dsscon=true console=2,115200 upgradesoftware=false" /dev/hda

Otherwise, enter this command:

bootpage -P "root=/dev/hda7 dsscon=true console=2,115200 upgradesoftware=false" /dev/hda

The "/dev/hdax" inside the quotation marks refers to the drive as it is connected in the TiVo. In most cases, you will not modify this. If you TiVo drive is currently set to slave or on the secondary IDE interface of your PC, you will need to modify the /dev/hda at the end of the line to refer to the proper drive.

These instructions are also available in the killhdinitrd support thread. Note the bootpage commands may not work with some Linux boot CD's. You will have to issue the commands from a telnet session when we get to that point.

All-In-One S2 Utilities Collection (a.k.a. TivoTools)
The TiVo software has very few commands built-in. This where the tivotools file that we downloaded earlier comes in.

mkdir /mnt/hda4/tivo-bin
mkdir /mnt/hda7/tivo-bin
tar -xvf /mnt/dos/tivotools.tar -C /mnt/hda4/tivo-bin
tar -xvf /mnt/dos/tivotools.tar -C /mnt/hda7/tivo-bin

The first 2 commands create a tivo-bin directory on both boot partitions. (If you were not able to mount partition 7 earlier, don't sweat it.) The third and fourth commands will extract the files into the newly created tivo-bin directories. This is per the instructions in the All-In-One S2 Utilities Collection thread.

Networking
Those crafty folks at TiVo restrict your TiVo from connecting to a network. I suppose it is for security reasons or maybe they just don't like us hackers. Of course, we are going to change that. This applies to standalone TiVo's with older software and especially DirecTiVo's.

For software versions 6.2a or below, enter these commands...

cp /mnt/hda4/etc/netfilter-enable /mnt/hda4/etc/netfilter-enable.bak
cp /mnt/hda4/etc/netfilter-disable /mnt/hda4/etc/netfilter-enable
mv /mnt/hda4/sbin/dhclient /mnt/hda4/sbin/dhclient.bak
cp /mnt/hda7/etc/netfilter-enable /mnt/hda7/etc/netfilter-enable.bak
cp /mnt/hda7/etc/netfilter-disable /mnt/hda7/etc/netfilter-enable
mv /mnt/hda7/sbin/dhclient /mnt/hda7/sbin/dhclient.bak

That should take care of the networking filters on both root partitions. If you receive any errors, don't worry. It just means there is an older software version on that partition that doesn't have the filters in place. If you want to enable DHCP, do not enter the dhclient commands (renames the dhclient). Your router will automatically assign your TiVo an IP address. You'll have to go into your router, though, to see what IP address it assigned your TiVo box in order to access it.

For everything above version 6.2a, do this:

mv /mnt/hda4/sbin/iptables /mnt/hda4/sbin/iptables.bak
cp /mnt/dos/iptables /mnt/hda4/sbin/
chmod 755 /mnt/hda4/iptables
mv /mnt/hda7/sbin/iptables /mnt/hda7/sbin/iptables.bak
cp /mnt/dos/iptables /mnt/hda7/sbin/
chmod 755 /mnt/hda7/iptables

Essentially, we are renaming the iptables file and copying a new, hacked one over. Then we make it executable. Don't sweat it if the hda7 commands do not succeed. If you want to use a dynamically assigned IP address, you'll need to find a dhclient file somewhere and copy it to the sbin folder. (Information shamelessly copied from here.)

rc.sysinit.author
I know you are eager to re-insert this drive back into the TiVo and see the fruits of your labor, but there is one more step. We need to create a startup script to run some stuff when the TiVo boots. Copy rc.sysinit.author to the /etc/rc.d/ directory on each of the boot partitions on the TiVo drive like so...

cp /mnt/dos/rc.sysinit.author /mnt/hda4/etc/rc.d
cp /mnt/dos/rc.sysinit.author /mnt/hda7/etc/rc.d

That is the lazy way. You will probably need to edit my file at some point, and you should know how to edit the file on your TiVo, and what the file does. This is optional, but helpful...

Issue this command to create and/or edit the rc.sysinit.author file:

vi /mnt/hdc4/etc/rc.d/rc.sysinit.author

This starts up the VI editor. I'm not going to tell you how to use it as there are many, many websites that explain the VI editor in detail. Do a search.

Here is what my rc.sysinit.author looks like:

export PATH=$PATH:/sbin:/bin:/tvbin:/tivo-bin:.
export TIVO_ROOT=
export MFS_DEVICE=/dev/hda10

#start bash
#/bin/bash /dev/ttyS2&
/bin/bash</dev/ttyS2&>/dev/ttyS2&

#set the IP address
ifconfig eth0 192.168.1.90 broadcast netmask 255.255.255.0
route add default gw 192.168.1.1 netmask 255.255.255.0 metric 1

#start telnet server
tnlited 23 /bin/bash -login &

#start ftp server
tivoftpd

sleep 500

#run fakecall
fakecall.tcl

#start tivowebplus
/var/hack/TivoWebPlus/tivoweb

#start mfs_ftp
/var/hack/mfs_ftp/mfs_ftp.tcl

The PATH command tells the TiVo where to look, by default, for files. Bash and telnet are already on the TiVo. Tivoftpd and fakecall.tcl are part of the All-In-One S2 Utilities Collection, the path of which we've included in our path statement (/tivo-bin). If necessary, change the IP address of 192.168.1.90 to whatever you want your TiVo to be. The gateway address of 192.168.1.1 should be the same as your router. If you did not rename dhclient earlier, you can delete or comment out these lines. Note we haven't installed tivowebplus or mfs_ftp yet. TiVo will attempt to find the files and execute them, but will fail, and just skip down to the next command.

When you are done, copy the rc.sysinit.author file over to the other root partition...

cp /mnt/hdc4/etc/rc.d/rc.sysinit.author /mnt/hdc7/etc/rc.d/

and set them as executable...

chmod +x /mnt/hdc4/etc/rc.d/rc.sysinit.author
chmod +x /mnt/hdc7/etc/rc.d/rc.sysinit.author

Telnet & FTP
Remove the TiVo drive from your PC, and put it back in the TiVo. Plug the TiVo back in and cross your fingers. If all goes well, you should be able to telnet to the IP address of the TiVo (ex., Start--Run--telnet 192.168.1.90 <Enter>) as well as FTP. Congratulations, your TiVo is hacked!

Other Hacks
Now that you have telnet and FTP access, you can install various other hacks with ease. The following are some of the most common hacks, depending on what you want to do.

While the hard drive is in the TiVo, the 4th and 7th partitions are read only. You will need to issue the following command before you can modify files on those partitions:

mount -o remount,rw / 

TivoWebPlus	Access your TiVo from your web browser. Allows you to do complicated searches for upcoming programs and record them. This one is highly recommended!
Superpatch	Does several things including automatically disabling encryption and enabling the home media option. For DirecTivo version 6.4a, download it here.
tivoapp Patches	The Superpatch takes care of most of these, but not all. If you intend to do any extraction via TyTool or MFS_FTP, you will need to disable encryption which is in post #8. May I also recommend the 30 second skip, which is in post #2. Post #13 explains how to format the command. For example, if you have a DirecTiVo with version 6.2 software, here are the relevant hex values to disable encryption: 6.2 00a3599c 0320f809 3C020000 The command would be as follows: echo -ne "\x3C\x02\x00\x00" | dd conv=notrunc of=tivoapp bs=1 seek=10705308
MFS_FTP	Allows you to extract and reinsert programs from/to your TiVo using FTP. The default port number is 3105. You will need to download 3 separate archives and extract the files to the same directory, thereby copying over outdated versions. The original author's license restricts someone from redistributing a working archive. For the dates and times to be accurate, you will need tzoffset.txt. You will need to change the number depending on the time zone you are in. The value is the number of seconds between your time zone and GMT time. For Eastern, the offset is 18000 (5 hours difference x 60 x 60). Central is 21600. Mountain is 25200. Pacific is 28800. If you have a DirecTiVo with TiVo software version 6.2, here is a working mfs_ftp.tcl.
TySuiteJ Freeware	Extracts and converts TiVo video files to .mpg files. Works with any operating system with the Java Runtime Environment installed.
tytompg Freeware	A simple command line utility that converts .ty or .tmf files to .mpg files. You will need to extract the .ty files from the TiVo first such as with MFS_FTP.
fakecall.tcl	It is not necessary for DirecTiVo's to call home since they receive guide data from satellite, and your TiVo may tattle on you for hacking it. There is a fakecall.tcl included with tivotools, but it does not work with the DirecTiVo software version 6.2. This version will.
USB2 Backported Network Drivers	These drivers will speed up your USB 2.0 Network Adapter.