# How to upgrade/hack your tivo with a Mac (I found the answer)



## voidptr (Feb 8, 2002)

I've pieced together a way to use MFSTools and any other tivo tools on a Mac. This works as well for Series 1 disks (which the current Mac build can't do) as well as get access to the ext2 partitions without installing the Ext2 extension into your Mac and the headaches that can cause. (And which can't read Series 1 drives anyway)

Personally, I think once you get this setup, it's easier than doing it the old way with a PC. No rebooting the box, no ripping out your good drives or mucking up the inside of your computer.

Ok, first things first:
This isn't a step by step or beginners guide. There's plenty of those already, pick your favorites and use them (you'll see what I mean in a minute). You'll probably need to fill in the blanks in a couple places.

It's slightly complicated. If you've never hacked a tivo before, read this a couple times. Then read the guides you picked out above a couple times. Then read this again. You'll need to understand that underneath OS X is a real Unix system, and be able to use the shell there.

I've tested this a couple times. If you melt your Tivo or Mac doing it, I'm not responsible.

It's accurate, but slow. Restoring a backup took maybe 20 minutes, if you want to expand to a new drive and preserve recordings, doing this on a G5 will probably take a while. If you own an Intel, see the notes at the bottom. If you own a Series 2, I'd try the native MFSTools first, and then use this to reset the kernel and tweak the ext2 partitions.

What you need:
Your favorite Linux tools. I have a boot disk with MFSTools 2.0 that has served me well over the years. You don't need a physical cd, just the iso will do, in fact it's quicker. You can also use the CD if you want. I also briefly tested Spike2k5's updated MFSTools disc with success on a 250 gig drive. Instantcake may work too (although I haven't tried it.)

USB or Firewire drive enclosures for each drive. I restored an existing backup, so I only used one. If you're doing a drive swap, you can also get away with one if you do it in two steps and switch drives in the middle.

QEMU . See the notes at the end, as you need to do a little work to get it. The current release won't work.

Also, collect any other files you need. If you're installing onto a drive that needs LBA48 support, this includes the appropriate LBA48 Kernel and tpip linux binary. If you've got an existing backup image, you'll need that.

Ok, on to the hard part.

Create a reasonable size disk image formatted with a DOS file system to shuffle files between OS X and Qemu. At the command prompt, run:

```
hdiutil create -size 2G -fs MS-DOS -o dos.dmg
hdiutil attach dos.dmg
```
to create a 2 gig virtual disk and attach it. A new drive icon should appear on the desktop and finder for the virtual drive.

Copy any files (Other than the boot cd) onto this drive.

Cable up your target (or source if you need to do a backup first) drive to the USB enclosure, and connect it. If OS X pops up a dialog that it doesn't recognize the drive, hit ignore.

Launch Disk Util. It should look something like this (Notice the USB drive and the Dos image):









Unmount the dos volume by clicking on the drive icon and clicking the Unmount button. Do not eject the drive, as that will remove OS X's mapping completely, and we still need it mapped later. At the same time, if OS X did mount any partitions on your USB drive, make sure to unmount them now as well. (Again, use unmount, not eject)

Click on the USB drive, and hit the info button. You should get a screen that looks like this:









Write down the disk number on the line that says "Disk Identifier:", in this case disk3. Close this window and repeat for the dos.dmg drive image.

Continued in the next post...


----------



## voidptr (Feb 8, 2002)

Ok, now we're ready to launch the Linux CD. At the shell, run qemu like this:

```
sudo qemu -hda /dev/rdisk2 -hdb /dev/rdisk3 -cdrom mfstools.iso -boot d
```
Where "rdisk2" is the name of the device you wrote down for the DOS image with an "r" prepended, rdisk3 is the name of the USB enclosure drive, and mfstools.iso is the image of the linux boot cd. (If you're using the real CD, use /dev/cdrom here instead)

Type in your password at the sudo prompt (We need to write to the raw disk device as root) and you should get a window that looks like this:








Hit enter to load the default configuration for now.

Once you get to the shell, mount the dos image that linux sees as /dev/hda1:









At this point, you can do everything you would normally do. The Dos image is /dev/hda, the tivo drive is /dev/hdb, and the cdrom (if you need to mount it) is /dev/hdc.

If you need to do a backup, write the output image to the /mnt/c directory you just mounted.

Here, I've kicked off an MFS Restore to the tivo drive (The video glitched a little on the restore line when I took the screenshot):









If you need to install an LBA48 aware kernel, now is the time to do that as well.

Unmount the dos partition with "umount /mnt/c", and exit Qemu.

If that's all you needed, you should be able to now swap the drive back into the Tivo.
If you have a Series 2, and you have the Ext2 driver installed in OS X, make sure it didn't mount any partitions on the Tivo drive when you exited Qemu before you pull the drive.

If you want to access the ext2 partitions to setup TivoWeb or whatever, restart Qemu with the same command as last time. If you have a Series 2, you can just hit enter at the boot prompt and continue. If you have a Series 1, you need to run with byteswapping turned on. With this image, we do this with "vmlnodma hdb=bswap":









Once it comes back up, your root should be available at /dev/hdb4 or /dev/hdb7, and your /var at /dev/hdb9:









Unmount everything again when you're done, and you should be good to go.


----------



## voidptr (Feb 8, 2002)

This is the only really bad part right now. You need a specific patched build of Qemu until a couple patches make it into the main distribution, which means you need to build it from source.

I built it with gcc 3.3 on a G5. If you need to build it on Intel, you're on your own at the moment, as it doesn't build right with gcc 4.0. There's supposedly patches to address this, but I haven't tried them. Wait for the next binary build, try it yourself, or skip and read the Intel Note at the end of this post.

First, you need xcode installed off your OS X disk for the compiler and SDK.

Grab the sources I did with cvs. This will create a directory called qemu in your current directory.

```
cvs -z3 -d:pserver:[email protected]:/sources/qemu co -D "2006-07-24 18:00" qemu
```
Save the attached patch to this post into the qemu directory just created.

Change into the qemu directory in the shell, and apply the patch you just downloaded:

```
patch -p1 < qemu-osx-blocks.patch.txt
```
Build and install (This installs in /usr/local. If you already have qemu installed, adjust as needed):

```
./configure --enable-cocoa --enable-adlib --cc=gcc-3.3 --target-list=i386-softmmu
make
make install
```
** Intel Note:
I haven't tried this. I make no guarantees it will work, nor can I tell you how. However, VMWare and Parallels may both support raw devices to the extent this trick will work with them as well on an Intel Mac. If it does, it's likely to be signficantly faster than it is for me on a G5. If it doesn't, I take no responsibilty for breaking your Mac. If you try it, let us know.

** Additional Note:
Running the mfstools cd under Qemu also works quite well on Linux, if you don't want to open the machine and swap drives around and bother with rebooting. Also, even if you use the latest boot cd, you can't byteswap SCSI devices, which is what USB enclosures look like, but if you run it under Qemu they get remapped back to IDE devices in the virtual machine and you can get to them. Just replace /dev/disk? with /dev/hd? or /dev/sd? as appropriate. If you host it under Linux, 0.8.2 works out of the box, you don't need to patch it.


----------



## Krokus (Jan 25, 2002)

I got this to compile on my g4 Imac. I'm getting this error.

XXX-Computer:~/qemu root# sudo qemu -hda /dev/rdisk1 -hdb /dev/rdisk2 -cdrom mfstools2.iso -boot d
starting qemu...
qemu: could not open hard disk image 'mfstools2.iso'

It tries to mount the disk and I tell it to ignore but by then it aleady says it couldn't open image. I'm using Tiger 10.4.8.

Thanks
Krokus


----------



## voidptr (Feb 8, 2002)

Krokus said:


> It tries to mount the disk and I tell it to ignore but by then it aleady says it couldn't open image. I'm using Tiger 10.4.8.


You've got the iso image in the current directory? Try using a fully qualified path name. Also make sure root can read it if your homedirectory is on a NFS share.


----------



## Krokus (Jan 25, 2002)

Yea, it's in the current directory and it does see it. Qemu tries to mount it. It tries to mount the disk to the desktop and the finder errors out and says "The disk you inserted was not readable by this computer. Do you want to ignore, initalize or eject." I hit ignore and the disk mounts to the desktop as cd rom and the contents are the mfs iso thats in my directory. hmm

Thanks
Krokus


----------



## voidptr (Feb 8, 2002)

Are you sure disk1 is the msdos partition you created? On mine OS X reserves that for the cdrom drive. It sounds like you're launching Qemu before OS X maps all the drives correctly. If your hard drive isn't formatted, you need to wait until after you get and dismiss the initialize or ignore dialog.


----------

