The SApper - A "Zipper-like" tool for standalone tivos - Page 2

JWThiers · 05-18-2007, 07:58 AM

Quote:

Originally Posted by Soapm

Ok, I found this though I have no idea what it means;

How many times can I expand using mfstools?
To answer this questions, we need to know how tivo drive is organized.
Tivo drive can have up to 16 partitions per drive.

"A" drive
Partition 1 - Modified Apple Partition Map
Partition 2 - Bootstrap 1
Partition 3 - Kernel 1
Partition 4 - Root 1
Partition 5 - Bootstrap 2
Partition 6 - Kernel 2
Partition 7 - Root 2
Partition 8 - Linux Swap
Partition 9 - /var
Partition 10 - mfs application region 1
Partition 11 - mfs media region 1
Partition 12 - mfs application region 2
Partition 13 - mfs media region 2
Partition 14 - mfs application region 3
Partition 15 - mfs media region 3
Partition 16 - Apple free

Glad you found this because I am not really up on a lot of the partition info and what does what. BUT I'll give you a WAG as to what they are based on the little I do know and the descriptions you provided.

Partitions 1 and 16 I haven't a clue about.

Partitions 2-7 These are the partitions affected by slice upgrades. They hold different versions of the Tivo OS, file system, the stuff that makes Tivo a Tivo. When a slice upgrade is done the "active set" (The 3 partitions that are actually being booted to (2-4 or 5-7)) is copied with the changes to the inactive set. Then the boot set of partitions is changed and a reboot happens and the inactive set becomes the active set and vise-versa. These partitions are required to remain so you can't just delete one set to get more space (answers your previous question). Both are needed in case you have a bad upgrade the system will have something to revert back to automatically. These partitions are normally read only.

Partition 8 - Not sure but would assume a swap file for linux.

Partition 9 - /var. Reading around you will references to hacks being kept in the /var directory and that /var is read/write or that /var periodically gets wiped. The linux OS is different than windows. One of the ways is that all devices must be mounted before they can be used and they will show up someplace in the directory structure like directories in windows. That includes partitions on drives. So when you hear references to /var on a tivo it is referring to this partition.

Partitions 10 - 15. Not positive exactly but the mfs partitions (I thought it was 1 big partition but I guess I am wrong) is where the shows are stored for your viewing.

Partitions 2-9 take up only a relatively small amount of space, I would guess low single digit gigabytes at the most if that. So deleting them would not gain you much and could brick the system.

Anyone that knows better feel free to correct, amend, append. Like I said I only have a very basic knowledge of the real inner workings of Tivo.

classicsat · 05-18-2007, 01:18 PM

TiVo sets up MFS partitions in pairs. Originally it was one pair, the Application with settings, guide data, season passes Now Playing Index, and things, and the loop videos. The Media parition is where programs are records. When they developed the DirecTiVo, with its then comparatively larger drive, they figured it was better to position the app/swap/var partitions in the middle of the drive, and have media paritions on either side of the OS. still though, A given media partiton needs an Application media, if even nulled. Expanding a drive adds two partitions therefore. In the case of that list, there are three pairs of partitions, so that drive is expanded to the limit standard MFS tools can expand it.

FWIW, the OS/swap and VAR are 128MB each. the root MFS APP partiton is 512MB.

rbautch · 05-18-2007, 03:14 PM

Quote:

Originally Posted by MarkF2

Yup saw that already. I was using Nero 7m then I tried Roxio, same thing. I'll search for the I/O Error

I just ran through the full SApper on my 240 standalone, and it worked fine. One difference in the SApper running on my Tivo as opposed to yours is the kernel that is used, which is a possibility for the reboot loop. Mine uses the killhdinitrd kernel, while yours uses the custom kernel that's on the CD because it's a prom modded tivo. As you run the SApper watch the output carefully, and jot down what it thinks your root filesystem partition is - it should be /dev/hda7 or /dev/hda4. Then try to manually apply the custom kernel that's on the sapper disk before you remove the drive from the PC. Another thing to try is running the /cdrom/bootpage - p /dev/hdX command on your drive to see if the version of bootpage I'm using is compatible with your tivo drive. As a last resort, do an mfs_backup of your drive and FTP it to me.

JWThiers · 05-18-2007, 08:26 PM

Quote:

Originally Posted by classicsat

TiVo sets up MFS partitions in pairs. Originally it was one pair, the Application with settings, guide data, season passes Now Playing Index, and things, and the loop videos. The Media parition is where programs are records. When they developed the DirecTiVo, with its then comparatively larger drive, they figured it was better to position the app/swap/var partitions in the middle of the drive, and have media paritions on either side of the OS. still though, A given media partiton needs an Application media, if even nulled. Expanding a drive adds two partitions therefore. In the case of that list, there are three pairs of partitions, so that drive is expanded to the limit standard MFS tools can expand it.

FWIW, the OS/swap and VAR are 128MB each. the root MFS APP partiton is 512MB.

Thanks that helps me understand some things a little better.

Soapm · 05-18-2007, 10:33 PM

I don't find a list of applications this hack installs and what those applications do. Am I just blind?

rbautch · 05-18-2007, 10:57 PM

Quote:

Originally Posted by Soapm

I don't find a list of applications this hack installs and what those applications do. Am I just blind?

Check the first post in the Enhancement Script thread (in my sig).

MarkF2 · 05-19-2007, 09:32 PM

OK I ran the SAPPER and noted that the root is hdc7 and the boot is hdc6.

I also ran bootpage which gave me the following string:
root=dev/hda7 dsscan=true console=1,115200 upgradesoftware=false

I also ran killhdinitrd on dev/hdc6. The last line reported was: Fatal no exploit found for this kernel.

I couldn't find my custom kernel b/c I wasn't sure where to look.

Put the drive in the TIVO and I'm still getting the loop. I'm trying to find my electric meter so I can make a serial cable. Hopefully I'll have a working cable in the next few days.

Quote:

Originally Posted by rbautch

I just ran through the full SApper on my 240 standalone, and it worked fine. One difference in the SApper running on my Tivo as opposed to yours is the kernel that is used, which is a possibility for the reboot loop. Mine uses the killhdinitrd kernel, while yours uses the custom kernel that's on the CD because it's a prom modded tivo. As you run the SApper watch the output carefully, and jot down what it thinks your root filesystem partition is - it should be /dev/hda7 or /dev/hda4. Then try to manually apply the custom kernel that's on the sapper disk before you remove the drive from the PC. Another thing to try is running the /cdrom/bootpage - p /dev/hdX command on your drive to see if the version of bootpage I'm using is compatible with your tivo drive. As a last resort, do an mfs_backup of your drive and FTP it to me.

MarkF2 · 05-19-2007, 11:02 PM

I got a working serial cable but I'm not reading anything from the TIVO. I set the parameters as specified from a different link with the baud speed at 115,200 which matches the bootpage return string.

MarkF2 · 05-19-2007, 11:03 PM

correction I got the password question, but nothing else. Not sure what I should be doing.

MungoJerrie · 05-20-2007, 05:40 AM

Don't hit "Enter" while it's booting - just let it boot to see the console messages. The password prompt is for the PROM menu. Also, it doesn't appear you have a killhdinitrd kernel installed. The "No exploit found" message is clear about that. Did you pay the $5 for the enhanced disc at dvrupgrade.com? You can get killhd kernels from them. Otherwise, you can try the hunt and peck method. Only very specific software kernels are vulnerable. Like the Zipper/SApper instructions say, buy the $5 disc.

MarkF2 · 05-20-2007, 07:51 PM

Yes I bought all of the files from DVRUPGRADE, the LBA48 Boot Disk, Slicer and the Instantcake. The KERNEL for my 649 series is supposed to have killhdinitrd built in.

The problem with the serial connection is that my drive goes into an endless reboot cycle so there is opportunity to just let it boot. The suggestion was to try to get the serial cable in there to see why it is going into the reboot cycle.

Keep the ideas coming

Quote:

Originally Posted by MungoJerrie

Don't hit "Enter" while it's booting - just let it boot to see the console messages. The password prompt is for the PROM menu. Also, it doesn't appear you have a killhdinitrd kernel installed. The "No exploit found" message is clear about that. Did you pay the $5 for the enhanced disc at dvrupgrade.com? You can get killhd kernels from them. Otherwise, you can try the hunt and peck method. Only very specific software kernels are vulnerable. Like the Zipper/SApper instructions say, buy the $5 disc.

rbautch · 05-20-2007, 08:40 PM

Quote:

Originally Posted by MarkF2

Yes I bought all of the files from DVRUPGRADE, the LBA48 Boot Disk, Slicer and the Instantcake. The KERNEL for my 649 series is supposed to have killhdinitrd built in.

The problem with the serial connection is that my drive goes into an endless reboot cycle so there is opportunity to just let it boot. The suggestion was to try to get the serial cable in there to see why it is going into the reboot cycle.

Keep the ideas coming

killhdinitrd won't work with a prom-modded tivo. One option is to use the custom kernel on the SApper CD, which is is based on the 7.2 kernel. It's called vmlinux.px, or vmlinux-7.2-Gen04.px, depending on which version of SApper you're using. Another option is to run replace_initrd on the kernel that is native to the tivo software image you applied. The script uses the custom kernel, which should work fine.

MarkF2 · 05-20-2007, 09:06 PM

I see vmlinux.px on the CD, I just couldn't figure out how to get it to load. I'm a newB so I'm learning as I go. So what is the command to load to vmlinux?

Thanks again for the help

Quote:

Originally Posted by rbautch

killhdinitrd won't work with a prom-modded tivo. One option is to use the custom kernel on the SApper CD, which is is based on the 7.2 kernel. It's called vmlinux.px, or vmlinux-7.2-Gen04.px, depending on which version of SApper you're using. Another option is to run replace_initrd on the kernel that is native to the tivo software image you applied. The script uses the custom kernel, which should work fine.

MungoJerrie · 05-21-2007, 11:17 AM

Quote:

Originally Posted by MarkF2

I see vmlinux.px on the CD, I just couldn't figure out how to get it to load. I'm a newB so I'm learning as I go. So what is the command to load to vmlinux?

The kernel (named vmlinux-7.2-Gen04.px on my SApper files) should work. It does have the initrd "nulled" which is what you need - as opposed to killhd as russ explained. To transfer it into your system - while the drive is in the PC you would do the following:

Code:

bootpage -p /dev/hdX

where 'X' is the drive letter of your tivo drive. It will either report 'root=/dev/hda4' or 'root=/dev/hda7' the kernel is root partition minus one (either 3 or 6). So to transfer in, you'd

Code:

dd if=/path/to/vmlinux-7.2-Gen04.px of=/dev/hdX3

if root=/dev/hda4 or

Code:

dd if=/path/to/vmlinux-7.2-Gen04.px of=/dev/hdX6

for root=/dev/hda7.

MarkF2 · 05-21-2007, 12:01 PM

OK - Thanks I'll give that a shot tonight and I report back the results.

MarkF2 · 05-21-2007, 07:22 PM

OK Maybe here's the problem. My SAPPER disc does not have vmlinux-7.2-Gen04.px. I only have a regular vmlinux.px. Could this be the problem and if so how do I get the correct vmlinux file? I already downloaded all of the files from DVR Upgrade for 649 unit.

Quote:

Originally Posted by MungoJerrie

The kernel (named vmlinux-7.2-Gen04.px on my SApper files) should work. It does have the initrd "nulled" which is what you need - as opposed to killhd as russ explained. To transfer it into your system - while the drive is in the PC you would do the following:

Code:

bootpage -p /dev/hdX

where 'X' is the drive letter of your tivo drive. It will either report 'root=/dev/hda4' or 'root=/dev/hda7' the kernel is root partition minus one (either 3 or 6). So to transfer in, you'd

Code:

dd if=/path/to/vmlinux-7.2-Gen04.px of=/dev/hdX3

if root=/dev/hda4 or

Code:

dd if=/path/to/vmlinux-7.2-Gen04.px of=/dev/hdX6

for root=/dev/hda7.

MarkF2 · 05-21-2007, 07:59 PM

Since I don't have the other version of vmlinux I tried the following command which still didn't work. I am still in an endless reboot sequence

dd if=/cdrom/vmlinux.px of=/dev/hdX6

MungoJerrie · 05-21-2007, 09:22 PM

Quote:

Originally Posted by MarkF2

Since I don't have the other version of vmlinux I tried the following command which still didn't work. I am still in an endless reboot sequence

dd if=/cdrom/vmlinux.px of=/dev/hdX6

Don't use 'X' use the actual letter of your tivo drive as your PC sees it; in general:

primary master /dev/hda
primary slave /dev/hdb
secondary master /dev/hdc
secondary slave /dev/hdd

You could have more letters if you have additional IDE controllers. Also, you should be able to see the drive letter mappings during boot messages or by using the 'dmesg' command. Hold 'Shift-PgUp' to scroll up.

MarkF2 · 05-21-2007, 09:47 PM

Sorry, that was my typo. I used the correct syntax "hdc6". The command ran, but the outcome was the same, endless reboot.

Quote:

Originally Posted by MungoJerrie

Don't use 'X' use the actual letter of your tivo drive as your PC sees it; in general:

primary master /dev/hda
primary slave /dev/hdb
secondary master /dev/hdc
secondary slave /dev/hdd

You could have more letters if you have additional IDE controllers. Also, you should be able to see the drive letter mappings during boot messages or by using the 'dmesg' command. Hold 'Shift-PgUp' to scroll up.

MungoJerrie · 05-21-2007, 09:54 PM

You're gonna have to get that serial working. Were you able to get past the PROM prompt by not pressing any keys while booting? If you're not pressing anything it could be your terminal client is sending spurious carriage returns. Maybe try something like TerraTermPro as a terminal client.

MarkF2 · 05-21-2007, 09:57 PM

If I press enter it gets me to the password entry. If I press nothing then I see nothing and the TIVO reboots. I'm using HyperTerminal.

Thanks for trying to help

MungoJerrie · 05-21-2007, 10:28 PM

Quote:

Originally Posted by MarkF2

I also ran bootpage which gave me the following string:
root=dev/hda7 dsscan=true console=1,115200 upgradesoftware=false

You posted this before. Could be fat-fingers, but there are a couple of typos. It should be:

Code:

root=/dev/hda7 dsscon=true console=1,115200 upgradesoftware=false

You were missing a slash in /dev/hda7 and it's dsscon not dsscan. Other than that, it looks correct. I assume you tested your serial cable and it's good. One other thing to verify is:

Code:

bootpage -b /dev/hdc

Should give you 6 for the boot kernel partition.

Code:

bootpage -a /dev/hdc

Should give you 3 for the alternate boot partition.

Another common cause of reboots is improper iptables. Did the SApper finish? It should have disabled iptables. The easiest way is to put a 'iptables -F' (no quotes) early in your /etc/rc.d/rc.sysinit.author file (like right after the PATH statement). Also, what is the size/permissions of your /sbin/iptables file? Post the results of:

Code:

ls -l /tivo/sbin/iptables

Assuming you have your root (/dev/hdc7) mounted at /tivo. You could also get at the kernel boot messages by mounting the 9th partition (/var) and looking for /log/kernel.

MarkF2 · 05-21-2007, 10:47 PM

Fat fingers and tired eyes. Those were typos b/c I copied them down poorly.

K here are the results:

bootpage -b gave me a 6
bootpage -a gave me a 3

I used the following syntax : ls -l /mnt/sbin/iptables and I got the following back:
-rwxr-xr-x 1 root root 19 May 21 19:54

When I tried the syntax as you proposed it didn't find it, so I mounted /dev/hdc7 as mnt and tried it the other way.

Yes the SAPPER ran completely the only odd part was the cp error on HACKS with i/o error.

Quote:

Originally Posted by MungoJerrie

You posted this before. Could be fat-fingers, but there are a couple of typos. It should be:

Code:

root=/dev/hda7 dsscon=true console=1,115200 upgradesoftware=false

You were missing a slash in /dev/hda7 and it's dsscon not dsscan. Other than that, it looks correct. I assume you tested your serial cable and it's good. One other thing to verify is:

Code:

bootpage -b /dev/hdc

Should give you 6 for the boot kernel partition.

Code:

bootpage -a /dev/hdc

Should give you 3 for the alternate boot partition.

Another common cause of reboots is improper iptables. Did the SApper finish? It should have disabled iptables. The easiest way is to put a 'iptables -F' (no quotes) early in your /etc/rc.d/rc.sysinit.author file (like right after the PATH statement). Also, what is the size/permissions of your /sbin/iptables file? Post the results of:

Code:

ls -l /tivo/sbin/iptables

Assuming you have your root (/dev/hdc7) mounted at /tivo. You could also get at the kernel boot messages by mounting the 9th partition (/var) and looking for /log/kernel.

texster · 05-21-2007, 10:48 PM

Try using Tera Term Pro
http://www.ayera.com/teraterm/

and use these settings: Baud/bps: 115200, Data: 8bit, parity: none, stop bits: 1, flow control: none

Also from your previous post:

Quote:

Originally Posted by MarkF2

I also ran bootpage which gave me the following string:
root=dev/hda7 dsscan=true console=1,115200 upgradesoftware=false

maybe try editing the bootpage so "console=2"

MarkF2 · 05-21-2007, 10:52 PM

How do I edit the bootpage to console 2?

Quote:

Originally Posted by texster

Try using Tera Term Pro
http://www.ayera.com/teraterm/

and use these settings: Baud/bps: 115200, Data: 8bit, parity: none, stop bits: 1, flow control: none

Also from your previous post:

maybe try editing the bootpage so "console=2"

texster · 05-21-2007, 11:15 PM

To edit your bootpage, the command is almost identical to when you "ran" bootpage -p The command to edit is :

bootpage -P "root=/dev/hda7 dsscon=true console=2,115200 upgradesoftware=false"

then check w/ bootpage -p

MarkF2 · 05-21-2007, 11:40 PM

K - this is getting interesting. I tried to use the string below typed in exactly as listed below with the " marks. I got back the following message: dev/hda does not appear to be a TIVO drive signature bytes 0x00 0x00 do not match expected byte values 0x14 0x92.

when I did bootpage -p I still got the exact string except console 1.

Quote:

Originally Posted by texster

To edit your bootpage, the command is almost identical to when you "ran" bootpage -p The command to edit is :

bootpage -P "root=/dev/hda7 dsscon=true console=2,115200 upgradesoftware=false"

then check w/ bootpage -p

MarkF2 · 05-22-2007, 12:00 AM

I added /dev/hdc to the end of the string and it took and changed to console 2. Now I'm trying to boot it in the Tivo

Quote:

Originally Posted by MarkF2

K - this is getting interesting. I tried to use the string below typed in exactly as listed below with the " marks. I got back the following message: dev/hda does not appear to be a TIVO drive signature bytes 0x00 0x00 do not match expected byte values 0x14 0x92.

when I did bootpage -p I still got the exact string except console 1.

rbautch · 05-22-2007, 12:03 AM

Quote:

Originally Posted by MarkF2

K - this is getting interesting. I tried to use the string below typed in exactly as listed below with the " marks. I got back the following message: dev/hda does not appear to be a TIVO drive signature bytes 0x00 0x00 do not match expected byte values 0x14 0x92.

when I did bootpage -p I still got the exact string except console 1.

Did you forget the first slash before dev/hda (should be /dev/hda), or was that a typo in your post? Another thing you can do is to mount the drive and check to see what /dev/ttyDSS is symlinked to. If it's /dev/ttyS1, then your bootpage is fine and you don't need to change it to console=2. Series 2.5 tivos use console=1.

MungoJerrie · 05-22-2007, 09:17 AM

Quote:

Originally Posted by texster

To edit your bootpage, the command is almost identical to when you "ran" bootpage -p The command to edit is :

bootpage -P "root=/dev/hda7 dsscon=true console=2,115200 upgradesoftware=false"

then check w/ bootpage -p

That would be correct if you were doing this on the tivo, but if on a tivo drive mounted in a PC you need to add the device you are writing to, as I believe Mark figured out. Couple of other things, since the size of your iptables suggests it was replaced, post the results of your /etc/rc.d/rc.sysinit.author and /sbin/iptables files, either by copying off your drive or redirecting the contents to a disk file.

Also, I'm pretty sure Russ is correct, the DT has serial at S1, so it would be console=1,115200.

Last but not least, are you rebooting with and without your USB network adapter plugged in? There are known issues with killhdinitrd kernels and network drivers (hence using backport). Not sure if the same is true for replaced initrd kernels, but it could be that 8.x software is incompatible with kernels from anything less.