How to hack your Tivo Series 2 (AT&T/Tivo/Comcast model) w/HMO to stream content to your computer.

Notes:

You can't extract previously recorded material. Keep checking dealdatabase.com over time to see if this changes:
Make sure you have the TiVo behind a good firewall. There is no password protection on anything. It's not that big a deal, but you don't want people turning your TiVo into a spam box.
Trust me: Don't use the sleeper CD. Don't use the two kernel monte hack. Don't avoid making the backup.
And most of all, don't blame me for anything.

Requirements

Initial Steps.

  1. Go to http://www.ptvupgrade.com/installation/instructions and find the installation instructions for your box. This will tell you how to remove the old hard drive and insert the new one.
  2. Go to http://www.ptvupgrade.com/support/bigdisk/ and download the LBA48 iso CD (I'm using 3.0) and burn it. ptvlba48-3.0.iso
  3. On the "PC" connect the old Tivo Drive and the new Tivo Drive to two different IDE cables. Hopefully, they are all set to "cable sense" on their jumper settings (the top of the drive will explain this). Most modern computers have "grey" plugs on their cables for the slave drive and "black" plugs on their cables for the master drive. They cannot be on the same cable. Make sure the CD-ROM remains connected

    4. The way I will refer to the drives is this:
    Drive LetterIDE LocationDescription
    a IDE Bus 0 Master Where your old hard drive was connected and where the old TiVo drive probably is now
    bIDE Bus 0 Slaveprobably empty
    cIDE Bus 1 Masterprobably your CD-ROM drive
    dIDE Bus 1 Slaveprobably your new TiVo Drive
    So, in my box I have a=OldTivo, c=CDROM, d=NewTivo.
    NOTE: MAKE SURE NO WINDOWS 2000/XP DRIVES ARE ATTACHED TO YOUR MACHINE. God help you if you do.
  4. Book up the box and put in the burned LBA48 CD in the drive and boot from it. You'll get an error if it's not in, just put it in and restart.

    5. Backup The drive

  5. Just to make sure you did it right, type in the following: 
    mfstool info /dev/hd?
     Where `?' is the letter of the drive you think it is. It should give you valid information about your drive.
    Then, Type in the following command replacing the ?'s
    mfstool backup -Tao - /dev/hd? | mfstool restore -s 127 -pxi - /dev/hd?
     Where the first `?' is the same as above and the second `?' is the new tivo drive.
    Note: Please, please, please do this right. The old one first, the new one second. Otherwise you're screwed and need to spend $20 on a InstantCake cd from ptvupgrade.com

    for example, I have hda as the old tivo drive and hdd as the new drive 

    mfstool backup -Tao - /dev/hda | mfstool restore -s 127 -pxi - /dev/hdd

    This will take a long time. I'm going on a hike in the meantime. If you don't want to backup all your old programs, google "mfstool backup" to find out which option is right for you.

    Note: if it seems to "hang" around 100-150, reboot and try again. I found that about 50% of the time it would have this "hang". So don't skip out until it hits 200 or so.

  6. Type in "halt". Turn off the machine, disconnect the power, and remove the old TiVo drive. Put it into storage. Get it out of the room! Then reboot the machine.

    7. Mod the kernel and enable telnet

    The default kernel that comes on the Tivo won't let you hack anything. You need to mod it with the "killhdinitrc" script. But, since you've downloaded the CD, the kernels are already on the drive.

    For the next parts, replace hd? with the location of the drive above

  7. Mount the "var" partition
    8. mount /dev/hd?9 mnt
    If this doesn't work, you're on your own. The hd?9 partition is the /var directory of the running tivo box. The hd?4 partition is the root partition (which is read-only)
  8. Unzip the hacked kernel
    Now we're going to make a directory to hold the new & old kernels. 
    cd /mnt
mkdir hack
cd hack
mkdir kernels
cd kernels
cp /cdrom/s2_kernels/4.0.1a/vmlinux.px.gz .
gunzip vmlinux.px.gx
mv vmlinux.px newkernel.px
    If you have a different software version, pick an different kernel.
  9. Use tpip to update the kernel 
    tpip -k newkernel.px -o oldkernel.px.bak /dev/hd?
     This will create the "hacked" kernel that will avoid the "initrc" checks.
  10. Create the rc.sysinit.author file to start a telnet daemon.
    We're now going to create an /etc/rc.d/rc.sysinit.author file. This file is called near the end of startup to allow TiVo to debug the system. We're going to add our modifications to this file 
    # Mount the root partition
cd
umount /mnt
mount /dev/hd?4 /mnt
cd /mnt/etc/rc.d
vi rc.sysinit.author
    Then add this to the file: 
    #!/bin/bash
PATH=/bin:/sbin:/var/hack:/tivobin:/tvbin
TIVO_ROOT=
MFS_DEVICE=/dev/hda10
IGNOREEOF=1000
export PATH TIVO_ROOT MFS_DEVICE IGNOREEOF
echo Turning off firewall ... >& /dev/console
[ -x /etc/netfilter-disable ] && /etc/netfilter-disable
echo Enabling telnet daemon ... >& /dev/console
tnlited 23 /bin/bash -login >& /dev/console &
    Then, you need to make it executable 
    chmod 755 rc.sysinit.author
  11. Type in sync then halt and then power off the machine. Remove the drive from the machine.

    12. Start up the Tivo box

  12. Place the new drive inside the Tivo box according to the instructions. Make sure you have all the cables attached, especially the one that goes to the front of the . Make sure you have screwed the hard drive down. Make sure you have the case closed (you don't need to screw it tight) Then power it up! It should "work correctly".

    13. Connect to the TiVo and remove encryptions

  13. From a computer, telnet to your Tivo. You should get a bash prompt. Success! It's now hacked. If not, you can reconnect it to the PC, mount hd?9, and look at the /mnt/log/kernel log. It should explain the error.
  14. Hack the tivoapp to remove decryption.
    The original information is here: http://www.dealdatabase.com/forum/showpost.php?p=139455&postcount=1

    The echo line is what is different in each version. You must type it in exactly. 

    mount -o remount,rw /
cd /tvbin
cp tivoapp tivoapp.orig
mv tivoapp tivoapp.tmp
cp tivoapp.tmp tivoapp
chmod 755 tivoapp
echo -ne "\x3c\x02\x00\x00" | dd conv=notrunc of=tivoapp bs=1 seek=8618248
mount -o remount,ro /
    At this point, you could reboot or keep going. In any case, you'll need to reboot either with the 'reboot' command, or to restart tivo itself.

    You must do this while the tivo itself is running. Don't try to do it from linux or you'll hose your box. If it works, you can delete tivoapp.tmp

  15. Copy & start tivoftpd
    You can follow the instructions here... http://www.tivohelp.com/archive/tivohelp.swiki.net/50.html
    Or you can download it directly 
    
cd /var/hack
http_get -T 0 -C 0 -D /var/tmp -U http://homepage.mac.com:80/steventamm/software/tivo/tivoftpd
chmod 755 tivoftpd.
    I put homepage.mac.com in italics because you may need to use the ip address.
    Then start tivoftpd. 
    ./tivoftpd.
  16. At this point, we're ready to copy over anything. We need the following: You can ftp them, or copy them. You can start them as well..
  17. Modify the rc.sysinit.author file to startup these things next time you reboot
    
mount -o remount,rw /
vi /etc/rc.d/rc.sysinit.author
    ... Add the following lines 
    
echo Starting FTPd ... >& /dev/console
tivoftpd &
echo Starting vserver ... >& /dev/console
vserver &
echo Starting mfs_ftp ... >& /dev/console
/var/mfs_ftp/mfs_ftp.tcl
echo Starting tivowebplus ... >& /dev/console
/var/hack/tivoweb-tcl/tivoweb &
    ... 
    
mount -o remount,ro /
  18. Optional: Run the ciphercheck.tcl script to make sure you are recording unencrypted.
  19. Get mplayer for your particular computer, connect to your tivo as outlined here:http://tivo-mplayer.sourceforge.net/
Then just search the internet for things that involve "ty" files, and there you go.