My adventures with a:

Toshiba SD-H400 combination Tivo/DVD player

Email me at:

Is your SD-H400 Broken?


Update Aug 22 2006: bump to 7.3.1, everything went fine :-)
5/5/2006: bump to 7.2.2, updated the backup section
2/25/2006: bump to 7.2.1
2/2006: new tytool version, and burned a DVD with tivo-extracted, edited video -- see TyTool below
9/2005: Cleanup doc and published scripts I use to create a fully configured and kill'ed disk
7/2005: added stuff about killhdinitrd and v7.1 system software
1/21/2005: newer TyTools, and easier tserver
12/31/2004: hack to get recordings to work in TWP with basic service -- see TWP section below.

Jump to:

Backup
Killhdinitrd getting Bash prompt with Telnet, and Ftping, etc.
Modifying the Toshiba using Sleeper's ISO, the "old" way
Indvidual Hacks, Tivowebplus, controlling OnScreen Display,
Gripes about the Toshiba unit
Factoids that I didn't know where else to put
Handy Linux commands that I use but often forget
Serial Cable

In late June 2004, in need of a DVD player, I bought a Toshiba SD-H400 combination Tivo/DVD player. Several thing caused me to buy it: I've always wanted a Tivo but didn't want to pay for their subscription and these combo units include a free "basic" service, it was pretty cheap ($200) not counting a couple of $50 rebates that involve subscribing to Tivo's pay service, and since Tivo is based on Linux there is ample opportunity to poke around inside and play with it's operation.

Due to running Linux, there is a very active hacking (meaning modifications) community, the main sources of information are a couple of forums, with considerable overlap: the DealDatabase forums , and the TivoCommunity forums. The Hack FAQ although dated contains much basic information.

The Toshiba contains an 80 hour tivo "series 2" built in.

Backup/Restore using MfsTools 2

The cardinal rule for Tivo modifications is to back up the original hard drive, then to restore to another hard drive that you then modify -- when things "go wrong" as they often do, you can simply restore the backup again to the backup hard drive (keeping the original hard drive for a *real* emergency).

You will need 3 things in addition to the tivo hard disk to accomplish this task

  1. A linux boot CD with mfstools, I use the PTVupgrade LBA48
  2. A pc in which to boot it
  3. A place to save from or restore to, the easiest being a dos-accessible (e.g. FAT32) drive or partition. Take note: NTFS, the default for windows XP will not work

By convention, my FAT partition is /dev/hda1, my source tivo drive is /dev/hdb, and my destination tivo drive is /dev/hdd (my boot cdrom is /dev/hdc).

To create backup image: 
 mount /dev/hda1 /mnt/e                          // mounts my  FAT drive writable7
 mfsbackup -f 4138 -6so /mnt/e/file.tiv /dev/hdb    // see note, below, about the f switch
 umount /mnt/e                                      // after, do cntl-alt-del to shutdown

To Restore:

 mount -o ro /dev/hda1 /mnt/e                    // mount ro for safety
 mfsrestore -s 127 -zpi /mnt/e/file.tiv /dev/hdd      //
To copy entire drive -- disk to disk directly:
mfsbackup -Tao - /dev/hdb | mfsrestore -s 127 -zpi - /dev/hdd                                                         //

Comments:

It seems like backups/restores used to go very quickly -- less than a minute... now they seem to drag on for like 5 minutes, i'm not sure why that would be. Mfsbackup reports that the uncompressed backup is 972MB and the (compressed) file usually ends up being about 130MBytes.

I did a full disk to disk copy of 1822MB in about 1 hour. I did this just for a test after going to 7.2.2 and the disk was nearly empty, just had a couple of shows recorded.

 

My first mis-guided approach to creating a backup using no special tools, just plain Linux (I used a "Dylan's Boot Floppy"):

 mount -t vfat /dev/hda7 /mnt                               // mounts my "f" drive
 dd if=/dev/hdc bs=32k | gzip -9c > /mnt/tivodisk.gz        // Took 10 HOURS!

I did this before ever powering on the Tivo. Although I guess theoretically this approach should work, but it takes a LOOONG time... and it turned out later that I had a system problem (bad RAM) and the .gz file was corrupted anyway.

In any event, a couple of days later, I followed the Hinsdale How-to for backing up and testing a restore of my original Hard drive using MFStools 2.0, which is available on ISO CD image (i used the included boot floppy image), the salient commands once booted up:

NOTE on mfsbackup options, Ahoymatey: "It's been mentioned many times that the -f option should not be used. Especially if you updated via slices. The fsid's for objects you need to backup might be higher than 9999. You wouldn't back up all the required objects in this case. You should either back everything up, or use the -l option" This thread has suggestions for the value to use, suggestions range from a low of 5, 64 and 400! Another point of interest, sleeper scripts uses -f 4138.

-l max Backup only streams less than max megabytes

Killhdinitrd

As of June 2005, I went back to my original (and unhacked) hard disk and got it to software update to version 7.1b [and around September 2005 I went through everything again to go to 7.2 -- the scripts reflect that and everything seems to work ok AND in Feb 2006 I updated to 7.2.1 with no problems]. Made a backup of the unhacked 7.1 and restored to a new (very nice, by the way) Hitachi 160GB hard disk, see my page for details. Then hacked it with killhdinitrd using the 3.1.5 kernel. Main thread here in series 2 support. Here are some background threads about how killhdinitrd works: Image won't take (newbie), Project #2 (newbie), Series 2 DIY (no scripts/ISOs) killhdinitrd walkthrough -or- How I learned to stop worrying and love killhdinitrd

Step 1 -- do a regular restore, in my case I am restoring the image created by tivoscripts. I booted from the PTVupgrade LBA48 v3.01 (there is now a newer version) boot cd, , and my fresh drive was hdb:

mfsrestore -s 127 -zpi backupFilename /dev/hdb    # Restores image and makes a swap file. Do I need the 'b' flag? 
bootpage -p /dev/hdb                               # find out root partition(will be either 4 or 7, command below assumes it was 4
bootpage -P "root=/dev/hda4 upgradesoftware=false dsscon=true console=2,115200" -C /dev/hdb

Step 2 -- copy the 3.1.5 killhdinitrd'ed kernel with dd, fixup the netfilters/iptables (this explains it), Nocso patch (needed if you want to extract video), add an rc.sysinit.author file, and install some handy bin tools (see script ddkilled below)

Step 3 (optional) -- Install applications, e.g. TivoWebPlus, mfs_ftp, unified mfs_ tools (tserver for Tytools) -- see script installApps below. Note, I had first went ahead and installed them "by hand", then tar'ed up the already configured/patched versions.

Step 4 (optional) -- expand w/mfsadd (use the -x. I wanted to hold off on this so I didn't script bother to script is), run the toshiba unlock.

You should be able to test in tivo after any of the steps.

If you want to be able to extract usable video, you must apply the nocso patch -- it is specific to the exact software version:

7.2.2 nocso patch, from superpatch: + 0x058eae0 "0c16c997 3c020000" verified May 3, 2006.

Details of Nocso patch for 7.2.1: checked out ok Feb 2006: 7.2.1-oth-01-2-540  0x188068/1605736(decimal)  was:0c16aed9  new: 3c020000. This apparently was known for quite some time, since it appeared as part of  superpatch way back in Sept '05 (+ 0x0588068 "0c16aed9 3c020000"):
Tivoapp's md5sum patched/unpatched: c55e9047a05eea0afb964fa43cc2e327 / f20e2b2ab197870cb04b9cd844e58a98

echo -ne "\x3C\x02\x00\x00" | dd conv=notrunc of=/tivoapp bs=1 seek=1605736

Details of Nocso patch: checked out ok with my 7.1b-01-2-264 on June 7,2005. Offset(VMA) 00691290 (subtracting 0x400000 leaves decimal 2691728), Original 0320f809, new 3C020000

echo -ne "\x3C\x02\x00\x00" | dd conv=notrunc of=tivoapp bs=1 seek=2691728

Details of Nocso patch 7.2: checked out okay, 7.2.0-oth-01-2 Sept 2005. Offset(VMA) 005893e0 (subtracting 0x400000 leaves decimal 1610720), Original 0c16ae9e, new 3C020000.

echo -ne "\x3C\x02\x00\x00" | dd conv=notrunc of=tivoapp bs=1 seek=1610720

As of sometime in August 2006, tivo is trying to push 7.3.1 to me, i guess they skipped over 7.3 for me.
Details of Nocso patch for 7.3.1 : array set patch_7_3_1_oth...0x056513c "0c1612a2 3c020000"

echo -ne "\x3C\x02\x00\x00" | dd conv=notrunc of=tivoapp bs=1 seek=1462588 (verified)

WARNING: the scripts are hard-coded for the active partiton, adjust accordingly...

#!/bin/bash

# This is script ddkilled7 (hard coded to dd to hdb6)

# assumes hdb is a restored, unhacked tivo hard drive
#   e.g. mfsrestore -s 127 -zpi /mnt/e/tivo/backup/backup /dev/hdb

# assumes bootpage is ALREADY hacked, see e.g. bpageScript

# assumes the tivo files are ALREADY mounted in /mnt/e
# e.g. mount -o ro /dev/hda1 /mnt/e

mkdir /tivo
mount /dev/hdb7 /tivo

# this script installs the "killed" kernel, and only basic apps...
# You should test the newly-hacked drive in tivo after this.

echo "### dd'ing killed kernel" 
# The proper destination partition is one less than the active root partition
# E.g. if active is 7, then the proper kernel part is 6
dd if=/mnt/e/tivo/killhdinitrd/3.1.5/vmlinuxKilled.px of=/dev/hdb6

echo "### fixing up iptable/netfilter and copying rc.sysinit.author" 
cp /mnt/e/tivo/scripts/rc.sysinit.author /tivo/etc/rc.d
mv /tivo/sbin/iptables /tivo/sbin/iptables.old
cp /mnt/e/tivo/scripts/iptables /tivo/sbin/
mv /tivo/etc/netfilter-enable /tivo/etc/netfilter-enable.backup
cp /tivo/etc/netfilter-disable /tivo/etc/netfilter-enable

echo "### Patching tivoapp, nocso" 
cp /tivo/tvbin/tivoapp /tivo/tvbin/tivoappPatch
#   There is no hexdump available in the PVRupgrade cd :-(
#   so only do the patch if sure this is right tivoapp!
#   echo hexdump should be  0320 f809 0000 0000
#   hexdump -s 2691728 -n 8 /tivo/tvbin/tivoapp
# Below is for 7.1b (verified ok)
#  echo -ne "\x3C\x02\x00\x00" | dd conv=notrunc of=/tivo/tvbin/tivoapp bs=1 seek=2691728 
# Below is for 7.2.0-oth-01-2 (checked out ok on 9/18/2005)
#  echo -ne "\x3C\x02\x00\x00" | dd conv=notrunc of=/tivo/tvbin/tivoapp bs=1 seek=1610720
# Below is for 7.2.1-oth-01-2-264 (tested ok)
#  echo -ne "\x3C\x02\x00\x00" | dd conv=notrunc of=/tivo/tvbin/tivoapp bs=1 seek=1605736
# Below is for 7.2.2-oth, it worked
#  echo -ne "\x3C\x02\x00\x00" | dd conv=notrunc of=/tivo/tvbin/tivoapp bs=1 seek=1632992
# Below is for 7.3.1-oth, NOT YET VERIFIED
echo -ne "\x3C\x02\x00\x00" | dd conv=notrunc of=/tivo/tvbin/tivoappPatch bs=1 seek=1462588

echo "### Dealing with var part" 
mkdir /tivovar
mount /dev/hdb9 /tivovar
mkdir /tivovar/hack;mkdir /tivovar/hack/bin
cp /mnt/e/tivo/scripts/tivoftpd /tivovar/hack/bin

# alphawolfs(?) tools. origianlly in .rar, but i un-rar'ed them and save a copy that way
cd /tivovar/hack/bin;tar xf /mnt/e/tivo/Extras/tivotools.tar
 
#!/bin/bash

# this is script installApps last modified 04/06/2006
# it installs preconfigured TWP, mfs_ftp, newer tserver...

# assumes the tivo files are ALREADY mounted in /mnt/e
# e.g. mount -o ro /dev/hda1 /mnt/e

# assumes active part (either 4 or 7) is ALREADY mounted in /tivo
# e.g. :
#  mkdir /tivo
#  mount /dev/hdb7 /tivo
 
echo "### un-tarring binary tools to /bin/hackbin" 
# alphawolfs(?) tools. origianlly in .rar, but i un-rar'ed them and save a copy that way. 
# I used to put these on var part but this way they won't get wiped out when tivo decides to clear var...
# (take note, i got an updated tivotools -- needs to be verified)
mkdir /tivo/bin/hackbin
cd /tivo/bin/hackbin;tar xf /mnt/e/tivo/Extras/tivotools.tar
cp /mnt/e/tivo/scripts/tivoftpd /tivo/bin/hackbin

echo "### Cleanup some exec's and cp newer smartctl"
# do some cleanup and update Smartmon executable
mv /tivo/sbin/restart /tivo/sbin/restartDontWork
mv /tivo/bin/smartctl /tivo/bin/smartctlOld
cp /mnt/e/tivo/Extras/smartmontools/smartctl /tivo/bin/hackbin

echo "### Copying new USB (alternate) /lib/modules" 
#set up new Usbmodules but don't use them, hotplug my Airlink 0b95 7720 device to usbnet
mkdir /tivo/lib/modulesUsb
cp /tivo/lib/modules/* /tivo/lib/modulesUsb
cp /mnt/e/tivo/usbobj/20050619/* /tivo/lib/modulesUsb
# didn't work right: ln -s /tivo/lib/modulesUsb/usbnet.o /tivo/lib/modulesUsb/ax8817x.o
# this works:
ln -s usbnet.o /tivo/lib/modulesUsb/ax8817x.o
mv /tivo/etc/hotplug/usb.map /tivo/etc/hotplug/usb.mapOrig
cp /mnt/e/tivo/usbobj/usb.map /tivo/etc/hotplug
# so when ready, (on the tivo) rename /lib/modules to something else,
#    and rename /lib/modulesUSB to /lib/modules (and reboot tivo)

echo "### Mounting /var partion"
mkdir /tivovar
mount /dev/hdb9 /tivovar
mkdir /tivovar/hack;mkdir /tivovar/hack/bin

echo "### Un-tarring binary tools to /var"
# alphawolfs(?) tools. keep a copy of them on /var, too.
cd /tivovar/hack/bin;tar xf /mnt/e/tivo/Extras/tivotools.tar
cp /mnt/e/tivo/scripts/tivoftpd /tivovar/hack/bin

echo "### Un-tarring Tivowebplus"
# TWP 1.0 final -- new scheme, untar my already-patched/configured executable
# cd /tivovar/hack;tar zxf /mnt/e/tivo/Extras/TivoWebPlus/TivowebMyToshiba.tar.gz
# next line was due to 7.2, and I now need to start TWP on a port other than 80
# mv /tivovar/hack/tivoweb-tcl/tivoweb.cfg /tivovar/hack/tivoweb-tcl/tivoweb.tclOrig
# cp /mnt/e/tivo/Extras/TivoWebPlus/tivoweb.cfg /tivovar/hack/tivoweb-tcl/

# TWP 1.2.1 runs great on 7.2 w/o any patches (just can't use port 80, thus the tivoweb.cfg)
cd /tivovar/hack;tar zxf /mnt/e/tivo/Extras/TivoWebPlus/tivowebplus-1.2.1.tar.gz
cp /mnt/e/tivo/Extras/TivoWebPlus/tivoweb.cfg /tivovar/hack/tivowebplus/
# I realized in Feb'06 that i was neglecting to copy the (hard-patched for Toshiba)
#   sched.itcl, without this patch, you will be unable to schedule recordings via TWP: 
cp /mnt/e/tivo/Extras/TivoWebPlus/721/sched.itcl /tivovar/hack/tivowebplus/modules/


echo "### Un-tarring (good) tserver (e.g. for Tytools)"
cd /tivovar/hack;tar xf /mnt/e/tivo/Extras/TyTool/mfs_bin.mips-20041213a.tar
# now copy an updated tserver that came with tytool10r4
mv /tivovar/hack/mfs_vplay_tserver/bin.mips/tserver /tivovar/hack/mfs_vplay_tserver/bin.mips/tserver.old
cp /mnt/e/tivo/Extras/TyTool/TyTool10r4/TSERVER_Series2_MIPS/tserver  /tivovar/hack/mfs_vplay_tserver/bin.mips/tserver
# finally, link it to a folder in the path...
ln -s /var/hack/mfs_vplay_tserver/bin.mips/tserver /tivovar/hack/bin/tserver

echo "### Un-tarring pre-configured mfs_ftp (for e.g. eTivo)"
# mfs_ftp -- untar my already-patched/configured executable
cd /tivovar/hack;tar zxf /mnt/e/tivo/Extras/mfs_ftp/MfsFtpMyToshiba.tar.gz

My bare-bones rc.sysinit.author file:

#!/bin/bash
export PATH=$PATH:/var/hack/bin
# Put Console output on the Serial Port
/bin/bash < /dev/ttyS2 >& /dev/ttyS2 &
# Start Telnet with Bash Shell
tnlited 23 /bin/bash

 

Sleeper's ISO, a.k.a. TivoScripts v1.02

This section is here only for a historical curiosity -- there is no reason to do this anymore, see killhdinitrd

[ The Sleeper method is now (September-ish timeframe) officially deprecated (i.e. obsolete) -- see killhdinitrd method. Be sure and read the notice at the beginning of the official Sleeper thread. There is also some addition ominous stuff there at the top of the thread (added 10/23/2004) about Sleeper being "banned forever" from the (dealdatabase) forums?? whatever that means]

It turns out that, by far, this is the easiest and most popular way to hack Series 2 Tivo's. There is very little in the way of documentation, and apparently the "official" way to learn about it is by reading this thread at dealdatabase, and there is a Wiki here but there's not much infomation in it. There are two main choices, (P)rom and (M)onte -- I don't know what Prom is for but it involves phsyically changing a PROM chip inside the subject Tivo -- so everything here refers to Monte!

For nuts-and-bolts, you can Alt-F2 with Sleeper booted up in your PC and have a look at the shell scripts themselves, they are in the directory /etc/scripts -- they are ephemeral by which i mean that you won't find them as files on the CD (they are buried in the initrd.img image?). I finally found a document buried somewhere on dealdatabase entitled "The Full Monte Using the montestuff.zip files" (I can't find that thread or link now! So I posted an html rendition of this document here, if that is a problem please let me know) which pretty much explains the steps involved in Sleeper's TivoScripts.

In outline, here are the steps I followed (stuff in red is only because I didn't use standard script-assumed drive layout):

At this point I can telnet and ftp just fine. Note that mfs_ftp isn't loaded by the scripts -- some sort of prohibition on redistribution.

Notes about the Sleeper process:
It is all driven off of a file called variables which is always in a directory called tivo, which is always located on the 1st partition of hda (must be a dos/fat partition). Also in that same directory there will be a copy of a kernel image (why?) called something like 2.4.20-Original.img as well as the MfsTools backup file called something like TivoBackup-07-22-04_18_46.mfs (i.e. date and timestamp in the filename). The contents of the variables file is critical to the proper operation of sleeper scripts, and would be needed if ever you wanted to do another sleeper restore, so here for posterity is the contents of my variables file:

m_bp=3
m_kernel=2.4.20
m_kernelfile=2.4.20-Original.img
m_o_lbasects=160086528
m_rp=4
m_tivoback=/cdrive/tivo/TivoBackup-07-22-04_18_46.mfs
m_installstate=M_RESTORE

Individual Hacks

Hard Drive Capacity Upgrade

Up until around October 2004, it was a complete mystery as to how to expand the Toshiba's recording time capacity -- there appeared to be some sort of special "capacity lock" that was not present in other Series 2's. Eventually Jamie figured it out and presented it in this thread: Toshiba SD-H400 hard drive expansion. The original scheme involved telnetting in and deleting a particular MFS object. A little later, Jamie posted a PC-side program that would remove the object on a tivo drive connected to a PC (no need to have a "hacked" tivo). In any event, since I already had a hacked Tivo, I simply did it via telnet commands:

/tvbin/tivosh                    // should give a percent sign prompt
mls /Config/DiskConfigurations   // should return two objects: "Active" and "80Gig80HourJyounetsu" both 
                                 // with the same number, called the FSID (usually 5245)
RubbishObjectByFsId <FSID>
restart

Also note the FSID can be found using TivoWebPlus if you have that going, choose the MFS from the main menu. Anyway, this worked fine for me. After restarting my tivo reported 132 hours of recording capacity on my 120G drive. The PC method (which I did not try) would allow a non-hacked tivo to benefit from a larger hard drive, just follow normal mfstool backup then restore with expansion and finally run the PC-side program from the thread.

TivoWebPlus (a.k.a TWP)

Most of the gory detail below applies to TWP-1.0-final. So you can save yourself a lot of reading by knowing that TWP-1.2.1 works right out of the box, the only mod I have to apply is the "basic service hack" -- see below in grey box.

TivoWeb, and the more recent TivoWebPlus, is essentially a web server that runs on the Tivo allowing you to control various aspects of your Tivo over a network using a standard web browser. Sleeper installs TivoWeb (not plus) but it doesn't work (on the Toshiba?) so I downloaded the latest TivoWebPlus from their official homepage. I went with the .tpm (Tivo Package Manager) form, it is called tivowebplus-1.0-final.zip. Unzip this on your PC and ftp the .tpm file to tivo and follow the readme instructions (it is executable on the Tivo). I didn't like what it did to my rc.sysinit so I ended up just putting in this line to my rc.sysinit.author: /var/local/tivoweb-tcl/tivoweb

Some stuff is way faster to deal with via a web browser than with the remote control, mostly in the "user interface" portion like nowshowing, todo, and suggestions. There are even a few extra features here like undelete programs.

The very clever part of all this is that anyone can extend TWP's functionality by writing modules -- e.g. I wanted to be able to backup my season passes so that if i wiped out a hard drive I wouldn't have to re-enter them all. Just such a module exists here. It's very easy to install -- the standard procedure is to download the .zip file to PC, and unzip the tarball. Un-tar into the modules subdirectory and do a quick reload (that's a menu option) of TWP.

Every time displayed by TWP is one hour later than it should be. I assume somehow the tzoffset is incorrect. I added a display of the variable tzoffset to the info.itcl which reports that it is -21600 -- but it should be -25200 (which is what is in /State/LocationConfig for TimeZoneOffset). I borrowed the line of code for the display from this thread , edit it into info.itcl: 

puts $chan [tr "" [td "tzoffset"][td "colspan=4" "$::tzoffset"]]

The problem appears to be that the daylightsavings gets messed up for version 5 so I changed httpd-tt.tcl to use what I think is the proper object (changed from earlier versions) instead of setting it to NULL. I posted this in the TWP thread at ddb... it works for me! Snippet from around line 684 (and also, this mod was incorporated into the newer TWP 1.2.1):

if { $::version >=5 } {
 # set daylightsavings ""
   set daylightsavings [dbobj $lconfig get UseDaylightSavings ]
} else {
   set daylightsavings [dbobj $lconfig get DaylightSavingsPolicy]
}

Currently, I have a fully functional TWP, and since system software 7.2xxx I have switched to TWP 1.2.1, which works right out of the box, the only mod I have to apply is the "basic service hack" -- see below in grey box.

Update December 31, 2004 -- It turns out that if you schedule a recording via TWP and you have basic service, the program doesn't get recorded! Below is a hack provided by an anonymous contributor. This worked like a charm for me:


# To make tivowebplus recordings work with basic service:
    * search tivoweb-tcl/modules/schedule.itcl [mine was called sched.itcl]
          o The statement that sets PresentationBehavior should set it to 12 instead of 1
          o The statement that sets ProgramGuideBehavior should set it to 3 instead of 1

This is o.k. if you only plan to use Tivo Basic service. There really should be some smarter code to allow a user configurable record mode (e.g. support regular tivo recordings or make all recordings use manual record mode--as the hack above does) instead of the brute force change I made, but I don't have the time to do this just now.

Getting TivoWebPlus-1.0-final to work on 7.1a (or higher):

Yes! I needed the patch to index.itcl

if {$::version >= 3} {
set guideindexdir "/GuideIndexV3"
} elseif {$::version = 2} {
set guideindexdir "/GuideIndexV2"
} else {
set guideindexdir "/GuideIndex"
}

now all is well with my TWP 1.0-final running on 7.1. To re-cap I had to do 3 things:

  1. the patch to index.itcl, above
  2. the patch to info.itcl mentined in my last post: "added the line "set durationsecs 0" to info.ictl after line 437"
  3. comment out two things in httpd-tt.tcl (the pool, and shaketcl) because those commands are not supported in tivosh.

Now, the console output you listed above is for 1.1pre2 -- so I gave that a shot. I did all the same things I just mentioned for 1.0final and started it up. It immediately (it did not even echo the "TivowebPlus Project..." line) said there was a problem in sendkey.itcl ($TmkEvent::EVT_MW_STATUS is undefined?) so I commented it out in httpd-tt.tcl. Once I did that, 1.1-pre2 startup console output looks just like yours, including the "error initializing channel table". And I can browse to it ok

Tivo Utils at Sourceforge

There is a collection of compiled binaries here. For example I downloaded and installed netbin-s2.tgz which includes the standard arp, ping, netstat commands. It just worked(!). Also here you will find cross compiler (i368 -> MIPS) tools, etc. and other handy links to datasheets and stuff. Many of the precomiled binaries here are already installed by the Sleeper scripts, e.g. pdisk, busybox, joe, the devbin collection.

Patching tivoapp

Several of the hacks involve changing a handful of bytes in the application /tvbin/tivoapp. For example the hack to prevent encryption ("noscramble" a.k.a. NoCso) of recorded materials is detailed in this thread, there are scripts here, too that will tell you the encryption status of your shows (had to make mfs_export executable to get script to work), for example ciphercheck.tcl. The exact bytes to patch will always vary with what specific software version of box/tivo, the general outline is to first make a backup of the app and shuffle it then patch the bytes -- specifically the no encryption hack for a 5.1.1b (the parts that are underlined will vary by exactly what version of tivo software is in use) is:

cd /tvbin
hexdump -s 10001408 -n 4 tivoapp        // First, VERIFY correct bytes are there: 0320f809 !
mount -o remount,rw /
cp tivoapp tivoapp.orig
mv tivoapp tivoapp.tmp
cp tivoapp.orig tivoapp
chmod 755 tivoapp
echo -ne "\x24\x02\x00\x00" | dd conv=notrunc of=tivoapp bs=1 seek=10001408

Applying this, then rebooting, seemed to in fact accomplish turning off the encryption (on newly recorded stuff) according to ciphercheck.tcl -- so currently this as far as i can tell now, works!

mfs_ftp

This will theoretically allow me to pull shows off the Tivo and manipulate them on a PC (with what editor?). Though I am not really clear why I would want to do this, or why I would do this rather than TyTools? By the way, redistirbution of mfs_ftp is expressly prohibited, which presumably is why it's not in Sleeper.

Installation on a Series 2 (like the Toshiba) is a three step process: 1) Download and install the latest mfs_ftp which is for series 1, 2) Get the series 2 binaries and put them over top, and 3) get some more stuff and put it over top. This is all explained in the aptly named thread: mfs_ftp: easy extract / insert via ftp protocols (there is a whole forum on the topic of video extraction). When i first started it, it threw some errors about the timezone, I don't know why there was no file tzoffset.txt but the quick and dirty thing to do was to simply create it (in my case put the line of text: set info(tzoffset) -25200 which is for GMT - 700), see this thread for further info. The version is Mfs_Ftp ver 1.2.9p - {sock22}. Other minutia: if you telnet to it, and issue the command "exit" it will shutdown the process.

Currently: everything works fine -- although I did have to remember to disable my PC's software firewall (this is true for many of the tivo applications.

TyTools

TyTools is a client(Windows)/server(Tivo) toolsuite for video extraction (and insertion?), editing, and even apparently DVD authoring. As of late 2004, there is a new version out, 9r18, as well as a different version of the tserver and getting it going on Toshiba is now easier. [Update: February 2006, the current version is 10r4 , I gave it a spin and it seems to work just fine. An updated tserver is included in the zip file, no longer needs the nowshowing.tcl helper]

  1. Don't forget to first disable encryption (see above, "Patching Tivoapp"), otherwise your shows will not be usable on your PC
  2. Tivo-side installation: get Jamie's "Unified mfs_* tools (originally tridge vplay)" tserver here. Send the file mfs_bin.mips-20041213a.tar.bz2 onto Tivo, bunzip2 it, un-tar it. Then you can just run mfs_vplay_tserver/bin.mips/tserver (put it in your rc.sysinit.author if you want it always started)
  3. PC side: get the TyTool9r18 distro and Cygwin dll here. Just unzip it.

That's it. It just worked! No messing around with special nowshowing.tcl or any other special Toshiba/v5 issues (don't forget to disable firewall if it's on).

Currently I can Get shows. By default they are .ty format, by selecting File | Multiplex Mode (under Network Options) TyTool will get the show directly in .mpeg format and, for example, play them in media player. I suppose there are many more tools for editing/etc. And eventually I need to try to figure out how to put them back on the Tivo -- a process known as "reinsertion". Transfers on my wireless-B network from Toshiba to PC take about 45 minutes to grab a 30 minute show recorded at Best Quality (1.3Gbytes, Ty reports .490megabytes/sec)

Another milestone, February 2006: I finally got a DVD-burner so I could try out burning edited tivo stuff. First do your edits and create the final .vob file using "File | VOBmux file" menu item. Then do a "File | Create IFO files/dirs" command. That launches what is in essense a gui front end to the open-source dvdauthor (and will need the cygwin dll in windows). With the gui you can associate menu items with .vobs and finally make the dvd file structure. The output also includes a dos-batch file that can be modified if need by to tweak the dvdauthor commands. In any event i did all that and used Nero 6 to burn a DVD-video using a DVD-R blank and it played back fine on the Tivo/Toshiba.

Below in tiny print, for historical curiosity, are the steps I went through to get Tytools going last summer:

I downloaded the stuff from the stick thread TyTool 9r17 - Extraction/Frame Accurate Editing/DVD , along with the necessary cygwin Dll. There apparently are a couple of known problems relating to getting it going on the Toshiba.

  1. Don't forget to first disable encryption (see above, "Patching Tivoapp"), otherwise your shows will not be usable on your PC
  2. The first problem I stumbled into is on the tivo side, when executing tserver_mfs7_mips (the Series 2 executable), I got the error: "failed to open [], Not a TiVo super block! (magic=0x00000000". This is solved by getting Musclenerd's version which appears to work. I couldn't get the client side server function main menu function to work, so I start it manually in telnet: /var/hack/tserver
  3. The second problem was that now when the server starts, which executes the NowShowing.tcl, I get errors relating to TimeZone problems. There was an identical problem noted in this thread (it really does pay to search the forums!). The solution was a NowShowing.tcl which works with Toshiba SD-h400 by wen1 -- this worked like a champ!
  4. The final setup problem I had was that when I tried to Get it would fail with "Data socket connect failed!" -- it turns out the problem was my (PC's) firewall was causing the failure. Disabling the firewall allowed me to get shows just fine.

The last thing i noticed when playing a show turned into .mpg and playing on the PC was strange, annoying flashing (sudden luminance changes) every few seconds. this was on an animated show. not sure what's up with that.

Smartmontools

There exists a toolsuite called the Smartmontools, which allows manipulation of all things S.M.A.R.T. (disk drive Self-Monitoring, Analysis and Reporting Technology System). The main command is smartctl, and there is a daemon smartd. Tivo series 2's have a smartctl (but no smartd apparently) command, but it's a very old version, mine had v1.2. There is a cross compile for series 2 of the latest version of the package, 5.26,here in the General Development Forum at ddb. There is some scheme to have it mail your tivo a message daily about SMART status in this thread -- I didn't mess with that yet. Mainly I just wanted to check out the internal temperature of my drive since i am a little worried that it's too hot since i messed with it -- but in any event smartctl says its only 45 degrees C (ambient is 80F). [update: currently running 37C but now it's winter here and ambient is 70F, and the tivo reported box temperature running 42C]

All-In-One S2 utilities collection

Get the rar file tivotools.tar.rar at this thread. I didn't have anything that read the rar file, so I ended up getting some sort of free tool called "WMD" (Weapon of Mass Downloading) to un-rar it. Just ftp the .tar file over to tivo, and un-tar. I made a subdirectory, /var/hack/tivo-bin, to hold everything, it un-tars at the current directory level, it doesn't make any subdirectories. I added that directory to my path in the rc.sysinit.author file.

OSD

Tivo's have a built in executable called osdwriter that can be executed from telnet that will simply cause the Tivo to display any .png image on the TV screen (actually it places the image "in front of" the TV image). There is no obvious way to make it go away, from what I gather the standard way is to display a 1x1 transparent image.

The information pertaining to this is found within the Series 2 Development Forum at ddb.

Xybyre (see this thread, "series2 OSD kind of working, but why does osdwriter fork?") has a package of pre-compiled stuff that allows text to be sent to any Series 2 Tivo over the network and renders it on the screen. These are designed to have something to do with popping up Caller ID on your TV, thus the program that listens for these messages is called yac (Yet Another Callerid program). I installed the package (just un-tarred it) actually to a non-standard place (it wants to be in /var/hack but I put it in /var/hack/osd, it insists that some of the files be in /var/hack/home). (I couldn't figure out how to set the shell variable LD_LIBRARY_PATH so I edited it into my rc.sysinit.author) -- and ran the yac program on Tivo (i ran it from the shell prompt, with a yac -D, for debug mode). To cause text to actually be displayed, you need a computer on your network to be a yac "server", so I downloaded the yac for windows from the official yac site. After loading that on the PC -- everything worked! That is i could send a text message (that is a function of the yac server, I don't have callerID) to my Tivo. To change the Tivo font size, place any .ttf font in /var/hack/home (this path seems to be hard-coded!) and call it yac.ttf -- this all worked pretty much as expected. Eventually I want to use a GAIM plugin that will direct text messages to the yac listener on Tivo. Still not working: the only thing out of this whole scheme that doesn't work is clearing the message, on my tivo the message just gets displayed until i send it another message. The disply of blank.png (which also must be in /var/hack/home) for some reason doesn't clear the screen.
So it mostly works, although the displayed text seems like it has a shadow(?)
In message #95 4/2004, lgkahn posted a displaytext.itcl -- I loaded it up and it makes a nice window in TivoWeb but doesn't appear to send any text to the Tivo :-( It refers to something called newtext2osd that I don't have -- see below.

In another thread "Series2 OSD" (seemingly disjoint from the Xybyre stuff, above?), message #22 there were a bunch of attached stuff -- so I downloaded their yac, osdwriter, elseed, newtext2osd, and libosd. If i try to run newtext2osd i get "Couldn't find or create shared front buffer" with no output to the tivo, but program does delay the -s seconds. [Update: this same problem has been noted and confirmed by Juppers as of 8/16/04, also on a Toshiba SD-H400]

Currently: The Xybyre method works, whic includes yac, and sending arbitrary text to the tivo via a special port... waiting on the so-called "native" stuff as discussed in "Series2 OSD".

 

Gripes about my Toshiba SD-H400

DVD player: does not play SVCD, apparently this is intentional, that is to say that SVCD is not one of the listed formats the player supports. I find this to be kooky. I still cannot get it to play VCD's either...it is supposed to according to Toshiba. I did get it to play MP3's.

Noise: this is really applies to Tivo's -- Let me preface the noise discussion by stating that the perception of noise as irritating is a HIGHLY individualistic thing. I am VERY bothered by noise...
I measured the power consumed by the unit: 166mA @ 120V = around 20W [this doesn't take into account the power factor but this is negligible], that's 175KW/hr's per year(!), it doesn't matter what mode, i.e. standby doesn't really do anything to reduce power.

Tivo's, by design,* never shut up. The only way to make them quiet is to unplug AC power. There are two sources of noise (disregarding the DVD drive, which is silent when not in use -- and makes what seems to be the normal amount of noise when operating): a 60mm(?) case fan, and the hard drive. The case fan makes (to me) the most objectionable type and amount of noise. Although I don't recommend doing this here is what I did:

This seems to be working fine, if a little messy -- but hey I'm forever swapping the hard drive in and out anyway. By the way, the stock hard drive, a Maxtor "QuickView" is very quiet, the bearing/spinning noise is minimal, and the head noise is just a faint ticking that i cannot hear in the room unless the rest of the house is DEADLY quiet. My "hacked" drive is a Seagate Barracuda 120GB and that is from what i can tell equally quiet.

* Tivo's are simply always on, despite what they call a "standby" power mode. They are constantly recording. If i would have known about this I probably would have never bought one. I note that over at a friend's house, a ReplayTV unit makes NO noise unless it is on and doing something productive.

Interesting(?) factoids about my Tivo

I copied the original Maxtor QuickView drive to a (larger) Seagate with Linux (booted under Sleeper ISO CD), and it worked fine i.e.:

	dd if=/dev/hda of=/dev/hdb bs=32k             //result: 2,501,352 records

The day before that, I copied a Seagate 120G to an identical drive using Norton Ghost 2003 with the -IA (image "all") switch and it took about 1 1/2 hours, the result worked fine.

MfsTool 2.0 mls command (list the MFS file system) apparently only works on /dev/hda.

Software version/details:

5.1.1-01-2-264, initially. 5.1.1b-01-2-264, after 2nd call and reboot)
7.1b-01-2-264 as of about August 2005 (i sortof skipped over 7.1a)
Tivo Service Number 2640000F024E771
Toshiba Serial Number: SLC3X04428
Maxtor "Quickview" 80G hard drive: Maxtor DiamondMax 16,
S/N:R290N99E, Model 4R080L04214P1, Mfg 19Jul2003 (almost a year old already!)
Model=Maxtor 4R080L0, FwRev=RAMC1TU0, SerialNo=R290N99E
LBA48 user addressable sectors: 160086528
device size with M = 1024*1024: 78167 MBytes
device size with M = 1000*1000: 81964 MBytes (81 GB)

For comparison, here is hdparm info on Hitachi Deskstar 80G, 16MB buffer:
Model=HDS728080PLAT20, FwRev=PF2OA21B, SerialNo=PFD212S2TNM1PD
LBA48 user addressable sectors: 160836480
device size with M = 1024*1024: 78533 MBytes
device size with M = 1000*1000: 82348 MBytes (82 GB)

Result of pdisk -l

Killhdinit'ed /expanded 160GB Hitachi: 
 #:                type name                             length   base      ( size )
 1: Apple_partition_map Apple                                63 @ 1        
 2:               Image Bootstrap 1                           1 @ 157447232
 3:               Image Kernel 1                           8192 @ 157447233 (  4.0M)
 4:                Ext2 Root 1                           524288 @ 157455425 (256.0M)
 5:               Image Bootstrap 2                        4096 @ 157979713 (  2.0M)
 6:               Image Kernel 2                           4096 @ 157983809 (  2.0M)
 7:                Ext2 Root 2                           262144 @ 157987905 (128.0M)
 8:                Swap Linux swap                       260096 @ 158250049 (127.0M)
 9:                Ext2 /var                             262144 @ 158510145 (128.0M)
10:                 MFS MFS application region           524288 @ 158772289 (256.0M)
11:                 MFS MFS media region               69400576 @ 88046656  ( 33.1G)
12:                 MFS Second MFS application region    524288 @ 159296577 (256.0M)
13:                 MFS Second MFS media region        88046592 @ 64        ( 42.0G)
14:                 MFS New MFS Application                1024 @ 159820865
15:                 MFS New MFS Media                 161849344 @ 159821889 ( 77.2G)
16:          Apple_Free Extra                              1727 @ 32167123

Original drive, note it only has 14 partitions

 #:                type name                             length   base      ( size )
 1: Apple_partition_map Apple                                63 @ 1        
 2:               Image Bootstrap 1                           1 @ 69400640 
 3:               Image Kernel 1                           8192 @ 69400641  (  4.0M)
 4:                Ext2 Root 1                           524288 @ 69408833  (256.0M)
 5:               Image Bootstrap 2                        4096 @ 69933121  (  2.0M)
 6:               Image Kernel 2                           4096 @ 69937217  (  2.0M)
 7:                Ext2 Root 2                           262144 @ 69941313  (128.0M)
 8:                Swap Linux swap                       260096 @ 70203457  (127.0M)
 9:                Ext2 /var                             262144 @ 70463553  (128.0M)
10:                 MFS MFS application region           524288 @ 70725697  (256.0M)
11:                 MFS MFS media region               69400576 @ 64        ( 33.1G)
12:                 MFS Second MFS application region    524288 @ 71249985  (256.0M)
13:                 MFS Second MFS media region        88046592 @ 71774273  ( 42.0G)
14:          Apple_Free Extra                          74620783 @ 159820865 ( 35.6G)

Tivo Glossary

SA - Stand Alone, presumably as opposed to integrated satellite box Tivo's.

Series 1 - The first(?) generation Tivo's. Based on a PowerPC (PPC) processor

Series 2 - The current (as of 2004) generation Tivo's. Based on a MIPS processor.

to reboot the Tivo via telnet do either (the restart command prints some stuff on the screen before the connection closes, the reboot just goes dark right away:

/tvbin/reboot
restart                          // restart is a script in /sbin, which calls reboot

Various Linux Commands I often use but often forget:

moved here.

 

USB2 Backport / Airlink 101 USB-Ethernet adapter "dongle"

Airlink101 adapter, model ASOHOUSB. Purchased at Fry's for 5 bucks! (Glen picked it up for me 8/29/2005)

See this post ax88178 and ax88772 support in the USB2 backport from 2.4.27 to 2.4.4/2.4.18/2.4.20 and a newer support thread.

I downloaded the executable, usbobj2.4.27-20050619.tar.bz2, and unpacked it -- bunzip2 and tar xvf. According to the readme's instructions, you must know whether you have a series 2 or series 2.5, the SD-H400 is a series 2, it is running 7.1b and kernel is 2.4.20. I did not need to disable dhclient.

  1. Update the file /etc/hotplug/usb.map: Under the section "device usbnet" add line "product 0b95 7720 Airlink Dongle".
  2. Backup /lib/modules in case of disaster
  3. Copy ./obj/hosts/2.4.20_Series2/* (ehci-dummy.o usb-ohci.o usbcore.o)
  4. Copy ./obj/drivers/2.4.20/* (various drivers, the airlink uses the usbnet.o. The prism drivers for my 802.11b wireless are here too -- but i can't get them to work...)
  5. make a symbolic link in the modules directory(I don't understand why this is necessary but it is! Why doesn't the usbnet.o module just get loaded?): ln -s usbnet.o ax8817x.o

Results, using Tytool and tserver:

Network Adapter Drivers Speed wired?
802.11b "prism" (dlink?) Original USB drivers 0.25MB/sec = 2mbs wireless
Airlink ASOHOUSB USB2-Ethernet dongle 20050619 backport USB drivers. Appears to be using usb-ohci and not ehci? Is that limiting speed? 2.5MB/sec = 20mbs wired
same, but connected via 802.11g WAP same 1.0MB/sec = 8mbs wireless

Serial Cable :

Tivo series 2, including the Toshiba SD-H400 has a stereo mini-headphone jack whose purpose apparently is to allow the Tivo to control an external satellite/cable box. This is a standard RS-232 serial port and can be used both to monitor the Tivo's bootup messages, and also to provide a full bash prompt with a hacked Tivo. My Toshiba came with a serial cable but in order for it to be used with a standard PC serial port -- you need to change the gender, as well as null (reverse transmit and receive data). I found it easier to cut off the end, and replace it with a female DB-9 connector.

Headphone Male DB-9 (the included cable) Wire color Female DB-9 (new connector)
tip 3 red 2
middle ring 2 white 3
outer ring 5 shield 5

To enable serial output, pass the parameters in the bootpage. You can do this without hacking the tivo by removing the tivo's hard drive and booting it up in a PC using a bootable linux CD, for example PTVupgrade LBA48

bootpage -p /dev/hdX          
bootpage -P "root=/dev/hdaY dsscon=true console=2,115200" -C /dev/hdX

Where X is the standard linux ide drive scheme (e.g. a is primary master, b is secondary master, and so forth). And Y is the result from the first command, it will be either 4 or 7.

To use on pc side just set terminal program to 115,200 baud with no flow control. To use as a full bash prompt, you have to hack the tivo and set the appropriate parameters, see the sample rc.sysinit.author file, above.

Is your Toshiba SD-H400 Broken?

It appears that circa mid-2006 many of these units failed (see, e.g. thread or thread, on tivo community forums). Mostly hard drive failures, though a couple of claims that a hard drive replacement didn't fix the problem. It's a looong thread, synopsis: it appears that there was a brief timeframe aound May 2006 where Toshiba was replacing broken SD-H400's with a new/refurbished RX-whatever (a combo DVD burner), and for no fee(!). Anyway, that was of course too good to last...The current deal appears to be that Toshiba will somehow fix (replace with a refurb?) the SD-H400 for a flat fee of like $140, which seems pretty pricey.

Symptom: It used to work, but now you don't even get any video. Very common after moving the unit.

Check that the P/I switch (Progressive/Interlaced scan) is in the correct position. If you don't know what this is or should be you almost certainly should have it in the I position.

Symptom: Tivo won't boot, e.g. Stuck on "Powering Up" (white text on grey background) or "Almost there".

Your hard drive is probably kaput. If you have made a backup image (you DID make a backup, didn't you?), see the procedures above for restoring. If you need an image, and you want to try to restore it yourself -- email me and I may be able to help you out. If restoring it yourself is beyond your level of geekiness, email me and I can arrange to have your drive re-loaded with my image for a nominal fee.

Symptom (hackers only): Tivo won't boot, you've connected a serial cable and the output says something like "InitTivoConfig: unrecognized board/platform id: 0x3000200... Couldn't get the memory size configuration... Enter password"

Check (double check!) that hard drive is jumpered properly (cable select or master). If you haven't been hacking or otherwise messing around inside the tivo, see previous symptom.

 

General tivo troubleshooting (not specific to SD-H400)

 

If you experience or know of any other symptoms (and hopefully, solutions): please email me so I can add them to the list

Stuff to look into

TCL -- what is it really? It stands for Tool Control Language. Here is the sourceforge page. apparently the program /tvbin/tivosh is a binary program which interprets tcl language scripts, thus tcl programs are really scripts beginning with the line #!/tvbin/tivosh

 

I tried it out and it worked well. Also with just 3 line of Tcl
code you can display any line of text with the YAC "client" running on the Tivo. (see Below)
#### put your Tivo's IP address below and run on a remote host
set s [socket 192.168.1.XXX 10629]
puts $s "Test Message"
close $s
####

Here's another example use: echo combined with piping the output to tivosh to test this stuff at a bash prompt, for example:

echo "puts \"[clock seconds] / [exec date] \"" | tivosh

Sendkey -- need to get the binary for series 2 to simulate sending remote keystrokes (via TWP

Mailsend(?) -- program to send emails

 

Numbski has some useful-looking instructions angled at a Dtivo and killhdinitrd.

 

Not sure what fsid (the -f xxxx switch) on mfsbackup to specify to get a full backup but leaving out any recorded shows, Hinsdale says to do 9999. Another example is from the tivoscripts uses 4138. I recently ran a backup of my original (but was updated from 5.1.1 to 5.1.1b) maxtor. I also went with the highest level of compression.

mfsbackup -f 9999 -9so filename /dev/hdb   # yielded about 1GB, took about 20 minutes
mfsbackup -f 4138 -9so filename /dev/hdb   # yielded about 130MB, took about 10 minutes

The backup made when I did tivoscripts way back when (mid-2004, it is now April 2005) turned out just 2MB bigger. I also has a file called tivo.bak floating around and that is 1.26GB and i suspect was done with -f 9999