The Full Monte Using the montestuff.zip files

Updated 11/06/2003 – fixed a typo in the command for installing the killinitrd image.

This is a revised tutorial based on using the files included in the montestuff.zip file. The montestuff.zip file can be downloaded from ftp://ftp.twinbrothers.com/. The original tutorial was put together by d7o based on hacking the S2 DTivo from the ground up using the monte hack developed by mrblack51 and many others.

Before we begin the actual hacking process, you should unzip the montestuff.zip file and move the required files to your root directory for easy access in Linux.

1. Unzip the montestuff.zip file and extract the contents to a directory of your choosing. You will end up with two main directories, docs and tivo, and the manifest.txt file. Check the contents of the file against the manifest.txt file included in the zip file. You won’t need all of the included files but check them to make sure nothing’s missing to be safe.
2. Open the tivo directory and copy the devbin and the img folders to the root directory of your C: drive. Do the same for the individual files in the tivo directory. You won’t need the monte folder for the hack as its contents are already included in one of the other files.

You will also need to download the s2dtivo_files.zip folder from http://hostfreedom.com/tivo/s2dtivo_files.zip. Extract these to a folder on your C: drive. Navigate through the folders you just unzipped and check the file names for the Ethernet drivers. They have a tendency to get renamed with underscores in the file names instead of dashes when they’re extracted. Rename the affected files, as necessary. Burn the johnnydeath_cd mfstools2.iso file to a CD-R as an iso image. You will need this disk to boot from throughout this procedure. Test it on your PC before you connect your DTivo drive to make sure it boots properly.

The following procedure assumes that you have installed your Windows C: drive as primary master, CD-ROM drive as primary slave, and DTivo A drive as secondary master.

1) We first need to get a backup of the 3.1.0 or 3.1.1 OS. Insert the drive into the (off) computer as secondary master and boot up to the mfstools (i.e. johnnydeath’s) cd. As soon as you're at the # prompt you're ready for step 2.

2) We need to mount the partition where we're going to store the image.

mount /dev/hda1 /mnt/c

3) Now we're going to create the backup.

mfsbackup -f 4138 -6so /mnt/c/tivo-s2.bak /dev/hdc

4) Once that’s done, and it'll take a little bit, unmount the storage partition.

umount /mnt/c

5) If you plan on using a different drive for the monte hack then reboot and power off the computer at the POST screen. Remove the original DTivo drive and install the new drive as secondary master. Skip to step 6 to restore the image you just backed up to the new drive. If you plan on using the original drive for the monte hack then skip ahead to step 8 and begin hacking the drive.

6) To restore an image to your DTivo drive, mount the target drive as secondary master and boot with johnnydeath’s boot CD. At the 2^nd bash prompt, type in:

mount /dev/hda1 /mnt/c
mfsrestore -s 127 -xzpi /mnt/c/<image name> /dev/hdc

7) Unmount and reboot (to the CD).

umount /mnt/c

Press Ctrl+Alt+Del to reboot

8) After you have booted, you'll need to scroll back up to check the partitions tables using the Shift+Page Up keys. You need to scroll back and find the last hdcXX in the partition scan. The line following the partition identifier will be blank and the partition that precedes it should have a listing for "Applefree" in the string. This will probably be hdc16. This is where you are going to store a ROMFS (that later). At any rate, you need to find that last partition and remember its value.

hdc___

9) We need to mount the C: drive

mount /dev/hda1 /mnt/c

10) We need to find out the root FS on the new hd. To use the bootpage program we installed on the root directory of your C: drive (i.e. extracted from montestuff.zip), you first need to change directories. This isn’t all that necessary but it will make it easier and eliminate some extra typing when entering commands.

The bash prompt will now be indicated as /mnt/c in all subsequent steps.

bootpage -p /dev/hdc

11) As before you should get either root=/dev/hda7 or root=/dev/hda4. We are going to be installing the U5 kernel and FS in the opposite location. If you got root=/dev/hda7, then you'll be installing U5 kernel into /dev/hdc3 and U5 FS into /dev/hdc4. If you got root=/dev/hda4, you'll then be installing U5 kernel into /dev/hdc6 and U5 FS into /dev/hdc7. For me, I got root=/dev/hda7 so I'll be installing U5 into /dev/hdc3 and /dev/hdc4.

Root=/dev/hda__

If root = 7, U5 kernel = hda3 and U5fs = hda4

If root = 4, U5 kernel = hda6 and U5fs = hda7

One further note - mfsrestore creates /dev/hda3 (/dev/hdc3 boot up here where we've got the drive installed) as 2 megs in size. My original 3.1.0 drive had both /dev/hda3 and /dev/hda6 as 4 megs. I assume that's because Tivo wanted enough space in case things grew beyond 2 megs. All kernels currently released by Tivo are smaller than 2 megs. However, our U5 kernel is 4 megs only because we copied the full 4 megs of the partition from the backup. When we restore the U5 kernel to the 2 megs space (if you're restoring the kernel to /dev/hdc3) you will see an error message saying not everything was copied because of lack of space. This is OK. The first 2 megs were copied and thats what counts.

12) Restore the U5 kernel and U5 FS (in my case to /dev/hdc3 and /dev/hdc4 respectively)

dd if=/mnt/c/U5kern.img of=/dev/hdc3
dd if=/mnt/c/U5fs.img of=/dev/hdc4

13) We need to write the romfs image to the DTivo drive. We use the partition we found in step 8. For me it was /dev/hdc16.

dd if=/mnt/c/romfs.img of=/dev/hdc16

14) We now need to update the bootpage. For the bootpage, we are going to be setting the root=/dev/hda4. This is the location where you stored the U5 fs. If you wrote your U5 fs to /dev/hdc4 then you'll set root=/dev/hda4. If you wrote your U5 fs to /dev/hdc7, then you'll set root=/dev/hda7. Also, from step 8, you got your romfs partition. In the command below instead of using hdcXX we'll be using hdaXX. In my case, my romfs was written to /dev/hdc16 so in the command below I used /dev/hda16.

NOTE: The following data entry is on one continuous line. DO NOT PRESS ENTER UNTIL YOU HAVE TYPED IN THE ENTIRE COMMAND.

bootpage -P "root=/dev/hda4 BASH_ENV=\`mount\$IFS-n\$IFS/dev/hda16\$IFS/mnt;echo\$IFS/mnt/runmonte\`" -C /dev/hdc

Type in the above very carefully. Getting this wrong can cause problems.

15) Your bootpage is currently set to run either the 3.1.0 or 3.1.1 OS, depending on which one you currently have installed. Since we installed the 3.1.U5 OS in the alternate boot location, we need to 'flip' the bootpage to boot to 3.1.U5.

bootpage -f -C /dev/hdc

16) One last thing to do. We need to killinitrd the 3.1.0 OS. Skipping this step will make you have to repeat the installation (yeah found out the hard way). You'll be reading and writing from the partition that contains your original kernel (not the U5 kernel we installed). If you wrote your U5 kernel to /dev/hdc3, then you'll be using /dev/hdc6 in this command. If you wrote your U5 kernel to /dev/hdc6, then you'll be using /dev/hdc3 in this command. I used /dev/hdc6. Refer to step 11 to see which partitions you need to use.

dd if=/mnt/c/311bkern2.img of=/dev/hdc6

17) Ok, we've got a monte installation but we really need to install some hacks. Mount the 3.1.0/3.1.1 FS. For me this was /dev/hdc7. It could be /dev/hdc4 if yours was backwards from mine.

mount /dev/hdc7 /mnt/tivo

18) What's hacking without a bash prompt

cat >> /mnt/tivo/etc/rc.d/rc.sysinit
/bin/bash</dev/ttyS2&>/dev/ttyS2&

end the above by typing 'ctrl-D'

If you are a vi person, you can do it your way instead of using cat.

19) The default stuff in /bin is sorely lacking.
cp -p /mnt/c/devbin/* /mnt/tivo/bin

20) We’ll get into installing hacks and scripts in the next section.

21) Unmount everything

cd /
umount /mnt/tivo
umount /mnt/c

22) Press Ctrl+Alt+Del to reboot.

23) Power off your computer at the POST screen, remove the DTivo drive from your PC, and put it back in your DTivo. You should be running the full 3.1.0/3/1/1 OS with bash.

24) Connect your serial cable between your PC and your DTivo. Power up the PC and open up TeraTerm. You can also use Hyperterminal or other terminal program but TeraTerm works great for communicating with a Tivo so any subsequent steps will reference the use of TeraTerm. If you use a different program then you’ll have to figure out how to modify the steps to use it.

25) Select the serial connection radio button and the Com port you’ll be using and click on OK. Pull down the Setup option and select Serial port. Set the baud rate to 115200 and click OK. With the cursor active in the terminal window, press the Enter key. You should see a bash prompt appear. If the bash prompt is not there then you’ll have to retrace your steps and possibly start over. Once you’ve got bash then you can proceed to installing hacks and scripts in the next section.

26) If you haven’t already done so, connect via serial port with TeraTerm and get your bash prompt per steps 24 and 25. The following steps for installing the hacks are not locked in concrete. You can set them up in any directory of your choosing. Just make sure that if you choose a different directory for installing the hack files that you use the correct path name when referencing the location of these files in the rc.sysinit.author file you will be generating later. Type in:

cd /var

mkdir hack

cd /var/hack

mkdir lib

mkdir bin

mkdir mfs_ftp

mkdir tserver

cd /var/hack/lib

27) In TeraTerm, select the File pulldown menu, then Transfer|Zmodem|Send. Navigate to the s2dtivo_files directory you extracted at the beginning of this tutorial and open up the ethernet_drivers folder. Make sure the file names do not contain any underscores in the names or you will have to rename them either before or after transferring them to your DTivo. This is not really crucial but it makes things easier if the file names match the names used in this tutorial. Select all of the drivers in the folder and click on Open. All of the files will then be transferred to your /var/hack/lib directory on the DTivo.

28) When all files have transferred, type in:

chmod –R 777 /var/hack/lib

cd /var/hack

29) In Windows, open up the 31tivoweb_v1.9.4-final.cpio.gz file using Winzip. Right-click on the 31tivoweb_v1.9.4-final.cpio file and select Open with…. Select TextPad and the file contents are displayed in an editing window. Select the Search|Find option at the top and type in "001 011 031" in the "Find what:" field. Make the following changes to the file:

LINE 637: Change from
if { [lsearch "001 011 031" $suffix] >= 0 } {
to
if { [lsearch "001 011 031 151" $suffix] >= 0 } {

Scroll down to LINE 656: Change from
} ;[base64dec]
to
}

Select File|Save as and select No change for the file format since it’s already in Unix format. Close the Winzip program.

30) Repeat step 27 for the tivoftpd and 31tivoweb_v1.9.4-final.cpio.gz files located in the tivoftpd and tivoweb folders, respectively.

31) Type in:

32) Type in:

33) Repeat step 27 for all of the files in the /tytools/tivo directory on your PC. Type in:

34) Type in:

35) Repeat step 27 for the kmem file in the kmem directory and tiviftpd in the tivoftpd directory on your PC. Type in:

chmod –R 777 /var/hack/bin

36) Type in:

37) Repeat step 27 for all of the files contained in the mfs_ftp folder on the PC. Type in:

chmod –R 777 /var/hack/mfs_ftp

38) Type in:

39) Repeat step 27 for the 31fixsub.tcl file.

40) Type in:

chmod 777 31fixsub.tcl

41) The rc.sysinit.author file can be customized to suit your personal preferences. Just make sure that the paths specified to any file name matches the actual path for the files on the Tivo. In the following example the Ethernet drivers being loaded are for a USB 2.0 to Ethernet adapter. If you are using a USB 1.1 adapter then comment out the USB 2.0 lines by preceding each line with a "#" sign and remove the "#" sign from the USB 1.1 lines (all except the 1^st statement identifying which drivers are being loaded). You will notice that the PATH statement near the beginning includes the /var/hack directory. This is not normally part of the PATH statement but I included it anyway. You can probably leave it out but I figured it couldn’t hurt.

To determine which IP addresses to use, find out what the IP address is for connecting to your router when performing on-line setup from your PC. This is the default gateway (gw) address. The broadcast IP will be the same address except that it will use a "255" as the last number in the sequence. The eth0 address is the IP address that you are assigning to your DTivo. I have other PCs on my home network that are assigned IP addresses by the router starting with 100 as the last set of numbers and going up from there (i.e. 100 – 199). I chose to use numbers between 200 and 254 for my assigned IP addresses on my DTivos. Just pick any number higher than the default gateway address and it should work fine. If you have other networked components it may be a good idea to see what addresses have been assigned to them by the router to avoid any conflict. If there is a conflict, shut down the other components and reboot them. The router will assign new IP addresses as the components are recognized.

Open up TextPad on your PC and create a new document with the following:

42) Proofread the file very carefully to ensure that all of the path names and file names correspond exactly with what’s on your Tivo. Make sure your Ethernet IP addresses correspond with the way your network is set up. When you’re satisfied that they are correct, save the file in Unix format as rc.sysinit.author.

43) Now would be a good time to see if your commands for the Ethernet configuration, telnet, and ftp will work as specified in the rc.sysinit.author file before you attempt to boot the DTivo. From bash, type in the following lines followed by the Enter key at the end of each line. Type in only the set of commands pertaining to the Ethernet adapter you will be using. Make sure you have the adapter connected to both your DTivo and the network. Observer the LEDs on the Ethernet adapter as you type in the lines to load the drivers. Both indicators should be on by the time you have finished loading all of the drivers. If the LEDs do not come one then stop and recheck the lines you entered for typos. If the commands are correct then you’ll need to make sure the path names are correct and the file names match. Make sure the proper permissions have been set for the files.

insmod /var/hack/lib/usbcore.o

insmod /var/hack/lib/usb-ohci.o

sleep 10

insmod /var/hack/lib/pegasus.o

insmod /var/hack/lib/usbcore.o

insmod /var/hack/lib/hcd.o

insmod /var/hack/lib/ehci-hcd.o

insmod /var/hack/lib/ax8817x.o

sleep 10

ifconfig eth0 192.168.1.204 broadcast 192.168.1.255 netmask 255.255.255.0

route add default gw 192.168.1.1 netmask 0.0.0.0 metric 1

tnlited 23 /bin/bash -login &

tivoftpd

Test the ftp connection using an ftp program and the IP address you assigned to the DTivo. Connect via telnet and see if you get bash. If everything works then your rc.sysinit.author file should be good to go.

44) At bash, type in:

45) Repeat step 27 to transfer the rc.sysinit.author file to the /etc/rc.d directory on the Tivo. Type in:

The Tivo will reboot and activate all of the installed hacks at bootup that are called out in the rc.sysinit.author file. Observe the Ethernet adapter if you have one connected to both your Tivo and your network, and make sure the connectivity indicators come on. They may not come on until the sequence where the Tivo is acquiring data from the satellite.

46) If the adapter lights do not come on by the time the DTivo has finished booting then there is a problem with the rc.sysinit.author file, the ethernet drivers, or both. Check the file names and the paths specified and make the necessary corrections in the rc.sysinit.author file in TextPad. Make sure you save the file in Unix format. Reconnect to the DTivo via serial connection and delete the existing rc.sysinit.author file and upload the new one and set the permissions per the steps outlined in steps 41 and 42.

47) Test the ftp connection using an ftp program and the IP address you assigned to the DTivo. Connect via telnet and see if you get bash. Use your web browser to connect using Tivoweb.

About fixsub: The fixsub program is set to run at bootup. If you start seeing nag messages about the DTivo not dialing in you can either reboot to run fixsub at bootup or run it manually from bash. If you have bcron set up you can schedule it to run automatically. I still have unresolved issues with bcron so I have not included any info on it here until I can get it working. To run fixsub manually from bash, connect via telnet or serial connection and type in:

About noppv: I have not included the noppv.tcl script but it can be added in exactly the same way as fixsub. Just upload it to the /bin directory and do a "chmod 777 noppv.tcl" to make it executable. Add a statement for running noppv at the end of the rc.sysinit.author file just like you did for 31fixsub.tcl. Again, it will only run at bootup. If you want to run it automatically you need to install bcron or run it manually from bash exactly as shown for 31fixsub.tcl.

Summary
--------------------------------------------------
Monte is the way to go for hacking series 2. No question about it. You can run the latest goods while running the latest hacks. You can even make it boot faster. And did I mention no more running U5 menus???

There are bound to be errors in the above instructions. If you see mistakes post a comment and I'll correct it.

Hacking potentially turns your DTivo into a brick. Be smart, keep your original DTivo hard drive in a safe, stored location and you shouldn't do any permanent harm.

I didn't create monte. I certainly don't get any kudos. MuscleNerd, alldeadhomiez and all you other gurus out there doing the real hacking deserve serious props.

Back to Tivo/Toshiba info