I-Appliance BBS The Official Source for Internet Appliance Upgrades and Mods BBS Main List | Sign In | Sign Up | Search | Help | Linux-Hacker.net Reply to Thread | Printer |

Home / I-Appliance BBS General / usdtv box SUCCESSFUL HACK Executed custom update script from a USB stick

SUCCESSFUL HACK (modified 0 times) keith721 Profile - Created /opt/mediaworks/etc/allowshell as an empty file - Modified /opt/mediaworks/bin/mmstartup to no longer call the fta_check program - Modified /opt/mediaworks/bin/sleeper to exec /bin/sh with no password check and no allowshell file - Generated a new /tmp/cklist file to include these hacks - Built a new rootfs.jffs2 image containing these hacks - Modified /diagnostics/start to change progress messages but not actually update flash RAM - Generated new signatures for all files - Copied directories to a USB flash drive - Inserted USB flash, plugged in unit, received freshly hacked progress messages - Re-tweaked /diagnostics/start to actually update the flash RAM - Generated a new signature file for /diagnostics/start - Updated the USB flash drive - Executed hacked script and wrote hacked rootfs.jffs2 image to flash RAM - Successfully re-started unit using new image 8^) 8^) 8^) None of this would have been possible without the generous assistance of: - Tim Riker, of www.eLinux.org, who posted the 2.7.11 and 2.7.15-FTA updates from USDTV - GPSfan, who provided a MIPSEL uClibc QEMU image with MIPSEL versions of strace and gdb - Tivo hacker 'tmesis' for his mips_dasm.pl, 'drnull' who extended it, and everyone else at dealdatabase.com - Dan Kegel for his work on the 'crosstool' package - codeman and niacin for getting this started 07-02-2007 16:56:25

RE:SUCCESSFUL HACK (modified 0 times) keith721 Profile GPSfan noticed the first update didn't swap the boot partitions to activate the new hacks. I cut out all the sections of the original 'start' script that weren't absolutely necessary to prove things worked. Unfortunately, that included the commands to swap the active partitions. :( I need to put that back in, and test everything again. But we're definitely moving along. The good news is the USB core and storage modules are built into the USDTV 2.4.18-12 kernel, so hanging a USB hard drive off the back is possible with no additional code. Installing and configuring the kaweth.o, pegasus.o, or other USB network modules and the tnlited daemon from the Tivo S2 utilities should allow full networking. Hopefully, we'll find out later this week. 07-02-2007 20:41:04

RE:SUCCESSFUL HACK (modified 0 times) keith721 Profile 8^( I've gone and bricked it. 8^( It's stuck in a reboot loop, and won't load a standard system update from the USB drive, either. On top of that, I don't have a working serial cable to read the console messages. 8^( 8^( 07-03-2007 18:22:44

RE:SUCCESSFUL HACK (modified 0 times) keith721 Profile I figured out what went wrong with my update package to cause the reboot loop. I changed the IP address value in the kernel command line from 192.168.0.1 to 192.168.1.35 to agree with my home network. Except the application software processes use the IP address to communicate with each other. When they can't talk with each other, they reboot the box. Because my serial port is totally wonky and won't show valid ASCII data no matter WHAT I've done, I got another box from eBay. It should arrive next week. With the next box, I'll take my time: 1) Get a working serial connection to the four-pin console port (so I can read the kernel console messages) 2) DON'T mess with the kernel command line IP address 3) Hang a USB hub off the back before attempting to connect any other USB devices. Because usbcore and usb-storage are compiled into the kernel, the box should be able to support a hub. In the meantime, I'm documenting their MMON and kernel configuration as best I can. 07-04-2007 16:49:59

RE:SUCCESSFUL HACK (modified 0 times) keith721 Profile Looks like a German hacker found the package I built and posted for GPSfan: http://de.pastebin.ca/600588 If you're reading here, post a message, bitte? Wie gehts? 07-05-2007 20:21:36

RE:SUCCESSFUL HACK (modified 0 times) keith721 Profile Actually, changing the IP address in the kernel command line DID NOT brick my first receiver. After finally getting a working RS-232 level shifter, I can read the MMON bootloader and Linux kernel messages. It appears the MTD flash RAM partition containing the root filesystem is corrupt, and the kernel panics when it can't chain to 'init'. Unfortunately, the MMON bootloader doesn't allow the input of commands. It only allows pausing execution by pressing the space bar quickly after a system reset. 07-12-2007 14:18:17

RE:SUCCESSFUL HACK (modified 0 times) lostinusdtvland Profile Keith721-How did you actually (step by step) install the package you developed onto the usbstick etc where could I get it? I have been hoping someone would come up with a way to possibly modify these boxes. I have 3 of the fta units that sometimes lock up when on channel 41 you have to do a full restart. I have one of the wallyworld units that hasn't skipped a beat for 2 years. thanks for any and all information. I am new to linux but it is fun working with it. Hope I didn't bother you too much with the questions 08-09-2007 22:06:57

RE:SUCCESSFUL HACK (modified 0 times) forumworx Profile I'm interested in helping further things along. I have a unit on its way. I'll get the serial port up and poke around. haven't touched linux in a while but should be helpful. I'll be back ;) 08-14-2007 20:23:31

RE:SUCCESSFUL HACK (modified 0 times) keith721 Profile Wow, I'm glad to see someone else wanting to help. Join the irc.freenode.net channel #USDTV and look up gpsfan. He's got a much smaller package that simply leaves you a root shell on the serial port. From there, you can just tweak things directly. We were trying to build and use the pegasus.o and kaweth.o USB ethernet kernel modules, but the 2.4.x kernel USDTV originally built has an alignment problem that causes things to go screwy. Staying tied to the USDTV box by a serial cable got old after a while. As for building a package that would install, I kinda went overkill the first time around. Once you obtain a root shell on the serial port, you can edit the mmstartup script to eliminate the fta_check, then edit the sleeper script to always allow serial port access. When you're on the serial port, it's easy to mount an ext2-formatted USB stick and copy other files onto the flash RAM. Let me reconnect my box and dump some of the files, and I'll post copies here for your review as soon as possible. 08-17-2007 20:48:55

RE:SUCCESSFUL HACK (modified 0 times) dogleg69 Profile Anyone still interested in hacking on this box? I think I have finally created a base that builds without bricking the unit. However, is not the prettiest build process. Had some problems with openssl 9.8 not supporting some of the FIPS functions like sha1 -hmac. Finally got around that. If there is any interst, please post. Otherwise, I'm going to move on to something else. 01-09-2008 20:18:34

RE:SUCCESSFUL HACK (modified 0 times) bbsux Profile What could we use this box for? 01-15-2008 19:23:43

RE:SUCCESSFUL HACK (modified 0 times) dogleg69 Profile Was originally going to try and make a cheap PVR out of it. But since Echostar announced the TR50 at CES, I don't know if it is worth the trouble. These boxes have an HD tuner, two Samsung K9F2808U0 16MB NAND flash, ATI x225, four hynix 128mb RAM chips. It has component, composite, toslink, and s-video out. USB 1.1. The EPG is pretty nice on it. If you have any ideas, please pass them on. Otherwise I'm going wrap this up. 01-16-2008 16:20:17

RE:SUCCESSFUL HACK (modified 0 times) bbsux Profile Well if you make it into a cheap security dvr, I'd be interested... But it would need composite in or rf in... 01-17-2008 18:03:49

RE:SUCCESSFUL HACK (modified 0 times) zath2008 Profile dogleg69, I'd be interested in what you have built and how. I'm GPSFan in #usdtv. I'm usually logged in there, but often times not at my computer. 01-17-2008 19:01:15

RE:SUCCESSFUL HACK (modified 0 times) lostinusdtvland Profile dogleg69 I am still at least interested in the 2.9.1 software version for this box that I understand you have. Is there going to be way to get the update and be able to put it on a usb stick? Thanks 01-18-2008 19:32:22

RE:SUCCESSFUL HACK (modified 0 times) boxnut Profile Hi folks: boxnut here. Ive been searching the web for many months trying to find info for getting into a db2010. I added a rs232 port to the box,and able to see the bootup..first a couple of questions-- is there a default password to enter mmon?? for the upgrade,does the usb stick need a special format/file system?? the box I have is not the fta but an ex-subbed.since the dimise of usdtv,the box has been usless. i'm hoping to mod this to 'fta'. I know little about linux,even less about hacking it. I am however,very hardware literate. I have a lot of ideas for the x225, (dvb-t already configured/dvb-s2/(an open source satellite project), any help/sugestions/pointers, would be hot. already learned from these threads, many thanks godspeed boxnut 01-19-2008 04:12:42

RE:SUCCESSFUL HACK (modified 0 times) dogleg69 Profile boxnut - There is some software to go from Subscription to FTA. http://elinux.org/Hisense - look at the bottom for the USDTV-2.7.15-FTA.tgz. I think Tim Riker put some instructions in that package too. Something that would be useful to people who have VCRs is to put a scheduled channel changer on this box. Then people can still use their VCRs to record. Not great, but it would allow people who can't or won't get a DVR to continue to use their VCRs. I will post the 2.9.2 soon (the orginal 2.9.1 plus fixed the system time - will update the system time when you turn off the box or ask for an EPG update and also removed the auto software update - i think). I'll either get someone to put it on a website or put it on a share somewhere. Will post when it is out there. Still testing it. 01-20-2008 18:27:08

RE:SUCCESSFUL HACK (modified 0 times) boxnut Profile thanks dogleg,,already have this file. tryed to load it to the box via usb-flash,but box doesn't seem to recognise the drive. have read the other posts,but still uncertain about my procedure.i'm new to linux, but learning. also i'm on a windows machine. Icould simulate any formatting for the flash,but would be dificult to load the files to it. I'll try an alternate boot with linux,to load the file structure. but would need an image of the format and file structure to initilize the flash. been looking for dos/win utilities that could format the flash as jffs2 etc. and still might have to mod the signatures so the box will accept the update. too bad this thing doesnt have a jtag port. thanks boxnut 01-22-2008 00:43:04

Reply to Thread | Printer | All times are PST Powered by UltraBoard v1.62

I-Appliance BBS General - NEWS, Breaking NEWS - linux-hacker.net BBS on CD Questions - User Groups in Your Town - E-Bay, Yahoo Auction LINKS ONLY (MODERATED) - Jokes & Humor - usdtv box I-Opener Areas - I-Opener General Posts - I-Opener Technical Stuff - I-Opener Technical Info Reference (MODERATED) WebSurfer Areas - WebSurfer General Posts - WebSurfer Technical Stuff - WebSurfer Technical Info Reference (MODERATED) Other I-Appliances - Virgin Webplayer - WebPal - MailStation - 3Com Audrey - ThinkNIC / Oracle NIC - Gateway/AOL Connected Touch Pad - Philips/AOL-TV - ACER NT-150 STB - MSN Companion - Compaq IA - Emachines IA - IBM NetVista IA - Intel dot.station - MSNTV2 Network Computers - Fujitsu-Siemens Scovery Linux Net Computers - GallantWeb Server Consoles - Dreamcast - xbox hacking Web Pads - Epods One General Post - Panasonic CF-01 - Fujitsu Stylistic 1200 - Cybiko Thin Clients - Thin Clients DigitalVideoRecorders - DTV Recorders, Replay, TiVo, Etc... - Tivo Hacks Linux - Midori Linux General Board - ITX MotherBoards Single Board Computers - Earth Computers mARMalade Elite Member Area MISC Areas - The Swap Meet WE TAKE NO RESPONSIBILITY FOR ANY TRANSACTION HERE AND NO COMMERCIAL POST PERIOD !!! - Wireless Net - Cameras - Robotics - Routers/Gateways - Mattel JuiceBox