# Hacking the TiVo Stream?



## wmcbrine

So, has anyone had a go at this at all?


----------



## section128drunk

Just got mine today, I can't image a reality where someone doesn't come up with a pc based way to forward the stream or a VPN


----------



## berkinet

Well, now we have the stream-in-a-roamio and still, it doesn't seem anyone has made any progress on some 'creative' alternate stream receivers.

There had been options for Mplayer and VLC to play streams from the TiVo, but that required vserver. Those hacks don't work with the official 'streams' and I doubt server will even run on newer TiVos. Besides, what's the point of adding a stream server to a product that already contains one.

Or... have my countless searches simply been poorly constructed and there is really something out there that will let me receive a stream on a desktop platform.


----------



## berkinet

No sooner did I post the preceding than I found this thread. While this neat little hack uses the older MPEG (I.e. I am not using the output of the stream), I am able to view video direct from the DVR on my Mac in VLC.


----------



## telemark

To do what though?

This has some pin analysis:
http://www.kernellabs.com/blog/?p=1987

There's a Tivo GPL release on tivo.com for it, but is long out of date.

It appears to use Roamio (intel) byte ordering. But it has a different bootloader and kernel (compiler?). Most likely they're using the code base from the Zenverge reference platform for the lower levels.

The Roamio Pro/+ would be interesting to look at, cause if it only has one Flash chip, how are two processors booting from it.


----------



## wmcbrine

telemark said:


> To do what though?


1. Access the streams from something other than the TiVo iOS app.
2. Use the Stream to encode inputs other than TiVo recordings.
3. ???
4. Profit!


----------



## telemark

Do we know what Mini<->Tivo or Stream<->Tivo communication looks like?Might it be similar to what pytivo (HMO) or kmttg (mind) is using?

The Stream hardware has some kind of software signature check, even though it's coming from another hardware/software code base.

I'm thinking that it might be less work initially to emulate a Stream on unlocked hardware than to unlock a Stream box.

The [L]GPL release contains:
ffmpeg-0.10.3
ffmpeg-0.5

Consumer hardware with that chipset,
Tivo Stream
new SimpleTV 
new SiliconDust
some Comcast X1 media gateways
Fios Media Server

Out of those, a Simple.TV is OTA so might be the most promising.

Was TS support ever fixed in tivodecode .3 or .4 patches?


----------



## wmcbrine

telemark said:


> Was TS support ever fixed in tivodecode .3 or .4 patches?


Not really.


----------



## puffdaddy

This link provides a good overview.



telemark said:


> Do we know what Mini<->Tivo or Stream<->Tivo communication looks like?Might it be similar to what pytivo (HMO) or kmttg (mind) is using?


Both streams of communication use MindRPC calls inside TLS, I believe. I think the authentication level is certificate, but requires a "higher-level" certificate than that granted to the iOS app certificate, IIRC.



> The Stream hardware has some kind of software signature check, even though it's coming from another hardware/software code base.
> 
> I'm thinking that it might be less work initially to emulate a Stream on unlocked hardware than to unlock a Stream box.


Yes, there's image checking similar to what normal tivo's use. The stream runs a slimmed down version of the tivo's software (no UI, no recording code, only streaming and xcoding, and some other modifications).


----------



## telemark

Here are the boot messages starting from when the Kernel assumes control,
running on an almost factory fresh standalone Tivo Stream.

Before the Linux Kernel, is U-Boot, which is OSS and on the Stream GPL release on Tivo.com. 
Most all the interesting commands are commented out though.

Before U-Boot, I'm not sure what if anything else is running.



Spoiler



0	Starting kernel ...

1	[ 0.000000] Linux version 2.6.33.3 ([email protected]) (gcc version 4.3.3 (Sourcery G++ Lite 4.3-154) ) #1 PREEMPT Mon Aug 13 12:22:15 PDT 2012
2	[ 0.000000] 'console=ttyS0,115200' is not whitelisted.
3	[ 0.000000] 'root=/dev/sda7' is whitelisted.
4	[ 0.000000] 'console=ttyS0,115200' is not whitelisted.
5	[ 0.000000] '[email protected]' is not whitelisted.
6	[ 0.000000] 'cca=0' is not whitelisted.
7	[ 0.000000] 'noinitrd' is not whitelisted.
8	[ 0.000000] 'rw' is not whitelisted.
9	[ 0.000000] 'rootdelay=7' is not whitelisted.
10	[ 0.000000] 'mac=:XX:XX:XX:XX:XX:XX' is whitelisted.
11	[ 0.000000] 'rootfstype=squashfs' is not whitelisted.
12	[ 0.000000] CPU revision is: 0101937c (MIPS 24Kc)
13	[ 0.000000] core_freq 499500000, hpu_freq 571500000
14	[ 0.000000] Determined physical RAM map:
15	[ 0.000000] User-defined physical RAM map:
16	[ 0.000000] memory: 08000000 @ 18000000 (usable)
17	[ 0.000000] Wasting 3145728 bytes for tracking 98304 unused pages
18	[ 0.000000] Initial ramdisk at: 0x98491000 (271464 bytes)
19	[ 0.000000] Zone PFN ranges:
20	[ 0.000000] DMA 0x00018000 -> 0x00019000
21	[ 0.000000] Normal 0x00019000 -> 0x00020000
22	[ 0.000000] Movable zone start PFN for each node
23	[ 0.000000] early_node_map[1] active PFN ranges
24	[ 0.000000] 0: 0x00018000 -> 0x00020000
25	[ 0.000000] Built 1 zonelists in Zone order, mobility grouping on. Total pages: 32512
26	[ 0.000000] Kernel command line: dsscon=true root=/dev/sda7 mac=:XX:XX:XX:XX:XX:XX console=ttyS0,115200 [email protected] rootdelay=7 rd_start=0xb8491000 rd_size
27	=0x42468
28	[ 0.000000] PID hash table entries: 512 (order: -1, 2048 bytes)
29	[ 0.000000] Dentry cache hash table entries: 16384 (order: 4, 65536 bytes)
30	[ 0.000000] Inode-cache hash table entries: 8192 (order: 3, 32768 bytes)
31	[ 0.000000] Primary instruction cache 32kB, VIPT, 4-way, linesize 32 bytes.
32	[ 0.000000] Primary data cache 32kB, 4-way, PIPT, no aliases, linesize 32 bytes
33	[ 0.000000] Writing ErrCtl register=00011010
34	[ 0.000000] Readback ErrCtl register=00011010
35	[ 0.000000] physmem_top = 0x20000000
36	[ 0.000000] Preliminary contigmem_top = 0x20000000
37	[ 0.000000] Contiguous region 1: 37752832 bytes @ address 0x9d5ff000
38	[ 0.000000] Contiguous region 8: 6291456 bytes @ address 0x9fa00000
39	[ 0.000000] Contiguous region of 44044288 bytes total reserved at 0x9d5ff000.
40	[ 0.000000] Memory: 81820k/131072k available (3386k kernel code, 49104k reserved, 864k data, 176k init, 0k highmem)
41	[ 0.000000] SLUB: Genslabs=7, HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
42	[ 0.000000] Hierarchical RCU implementation.
43	[ 0.000000] NR_IRQS:568
44	[ 0.000000] CPU frequency 571.50 MHz
45	[ 0.000000] uart baud 116487
46	[ 0.000000] Console: colour dummy device 80x25
47	[ 0.000000] console [ttyS0] enabled
48	[ 0.010000] Calibrating delay loop... 380.92 BogoMIPS (lpj=1904640)
49	[ 0.240000] Mount-cache hash table entries: 512
50	[ 0.360000] NET: Registered protocol family 16
51	[ 0.430000] lcl_timeout = fffff0
52	[ 0.430000] sys_timeout = fffffff0
53	[ 0.440000] zn200: PCI-e link is up!!
54	[ 0.700000] bio: create slab <bio-0> at 0
 55	[ 0.710000] SCSI subsystem initialized
56	[ 0.710000] usbcore: registered new interface driver usbfs
57	[ 0.720000] usbcore: registered new interface driver hub
58	[ 0.720000] usbcore: registered new device driver usb
59	[ 0.730000] pci 0000:00:00.0: BAR 0: assigned [mem 0x02040000-0x0207ffff 64bit]
60	[ 0.730000] pci 0000:00:00.0: BAR 0: set to [mem 0x02040000-0x0207ffff 64bit] (PCI address [0x2040000-0x207ffff]
61	[ 0.740000] pci 0000:00:00.0: BAR 2: assigned [io 0x2020000-0x202007f]
62	[ 0.740000] pci 0000:00:00.0: BAR 2: set to [io 0x2020000-0x202007f] (PCI address [0x2020000-0x202007f]
63	[ 0.750000] Switching to clocksource MIPS
64	[ 0.750000] NET: Registered protocol family 2
65	[ 0.760000] IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
66	[ 0.760000] TCP established hash table entries: 4096 (order: 3, 32768 bytes)
67	[ 0.770000] TCP bind hash table entries: 4096 (order: 2, 16384 bytes)
68	[ 0.770000] TCP: Hash tables configured (established 4096 bind 4096)
69	[ 0.780000] TCP reno registered
70	[ 0.780000] UDP hash table entries: 256 (order: 0, 4096 bytes)
71	[ 0.790000] UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)
72	[ 0.800000] NET: Registered protocol family 1
73	[ 0.800000] Trying to unpack rootfs image as initramfs...
74	[ 0.830000] Freeing initrd memory: 265k freed
75	[ 0.830000] squashfs: version 4.0 (2009/01/31) Phillip Lougher
76	[ 0.840000] ROMFS MTD (C) 2007 Red Hat, Inc.
77	[ 0.840000] msgmni has been set to 160
78	[ 0.850000] alg: No test for stdrng (krng)
79	[ 0.850000] io scheduler noop registered
80	[ 0.860000] io scheduler deadline registered
81	[ 0.860000] io scheduler cfq registered (default)
82	[ 0.980000] Serial: 8250/16550 driver, 2 ports, IRQ sharing enabled
83	[ 0.990000] serial8250: ttyS0 at MMIO 0xa1a30000 (irq = 188) is a 16550A
84	[ 1.000000] serial8250: ttyS1 at MMIO 0xa1a40000 (irq = 189) is a 16550A
85	[ 1.010000] serial8250.0: ttyS0 at MMIO 0xa1a30000 (irq = 188) is a 16550A
86	[ 1.020000] serial8250.0: ttyS1 at MMIO 0xa1a40000 (irq = 189) is a 8250
87	[ 1.040000] brd: module loaded
88	[ 1.050000] loop: module loaded
89	[ 1.050000] nbd: registered device at major 43
90	[ 1.080000] MTDRAM: addr=9fa00000 size=6144
91	[ 1.080000] Initializing USB Mass Storage driver...
92	[ 1.090000] usbcore: registered new interface driver usb-storage
93	[ 1.100000] USB Mass Storage support registered.
94	[ 1.100000] usbcore: registered new interface driver libusual
95	[ 1.110000] usbcore: registered new interface driver usbserial
96	[ 1.110000] USB Serial support registered for generic
97	[ 1.120000] usbcore: registered new interface driver usbserial_generic
98	[ 1.130000] usbserial: USB Serial Driver core
99	[ 1.130000] USB Serial support registered for MCT U232
100	[ 1.140000] usbcore: registered new interface driver mct_u232
101	[ 1.140000] mct_u232: z2.1:Magic Control Technology USB-RS232 converter driver
102	[ 1.150000] USB Serial support registered for pl2303
103	[ 1.160000] usbcore: registered new interface driver pl2303
104	[ 1.160000] pl2303: Prolific PL2303 USB to serial adaptor driver
105	[ 1.170000] dwc_otg: version 2.94a 27-OCT-2011
106	[ 1.370000] Core Release: 2.92a
107	[ 1.380000] Setting default values for core params
108	[ 1.380000] IRQ 195/dwc_otg: IRQF_DISABLED is not guaranteed on shared IRQs
109	[ 1.590000] Using Buffer DMA mode
110	[ 1.590000] Periodic Transfer Interrupt Enhancement - disabled
111	[ 1.600000] Multiprocessor Interrupt Enhancement - disabled
112	[ 1.600000] OTG VER PARAM: 1, OTG VER FLAG: 1
113	[ 1.610000] DMA_ALLOC: ctx: (null), size: 0x40, dmaadr: 9d2053a4
114	[ 1.610000] dwc_otg lm0: DWC OTG Controller
115	[ 1.620000] dwc_otg lm0: new USB bus registered, assigned bus number 1
116	[ 1.630000] dwc_otg lm0: usb_add_hcd/ registering irq
117	[ 1.630000] dwc_otg lm0: irq 195, io mem 0x00000000
118	[ 1.640000] Init: Port Power? op_state=1
119	[ 1.640000] Init: Power Port (0)
120	[ 1.640000] hub 1-0:1.0: USB hub found
121	[ 1.650000] hub 1-0:1.0: 1 port detected
122	[ 1.650000] i2c /dev entries driver
123	[ 1.660000] usbcore: registered new interface driver hiddev
124	[ 1.670000] usbcore: registered new interface driver usbhid
125	[ 1.670000] usbhid: USB HID core driver
126	[ 1.680000] u32 classifier
127	[ 1.680000] nf_conntrack version 0.5.0 (1284 buckets, 5136 max)
128	[ 1.690000] ip_tables: (C) 2000-2006 Netfilter Core Team
129	[ 1.690000] TCP cubic registered
130	[ 1.700000] NET: Registered protocol family 17
131	[ 1.700000] NET: Registered protocol family 15
132	[ 1.710000] NET: Registered protocol family 33
133	[ 1.710000] Waiting 7sec before mounting root device...
134	[ 1.850000] Indeed it is in host mode hprt0 = 00021501
135	[ 2.030000] usb 1-1: new high speed USB device using dwc_otg and address 2
136	[ 2.030000] Indeed it is in host mode hprt0 = 00001101
137	[ 2.240000] scsi0 : usb-storage 1-1:1.0
138	[ 7.360000] scsi 0:0:0:0: Direct-Access Multiple Card Reader 1.00 PQ: 0 ANSI: 0
139	[ 7.370000] sd 0:0:0:0: Attached scsi generic sg0 type 0
140	[ 7.940000] sd 0:0:0:0: [sda] 3907584 512-byte logical blocks: (2.00 GB/1.86 GiB)
141	[ 7.950000] sd 0:0:0:0: [sda] Write Protect is off
142	[ 7.960000] sd 0:0:0:0: [sda] Assuming drive cache: write through
143	[ 7.970000] sd 0:0:0:0: [sda] Assuming drive cache: write through
144	[ 7.970000] sda: [tivo] sda1 sda2 sda3 sda4 sda5 sda6 sda7 sda8 sda9 sda10 sda11 sda12 sda13 sda14 sda15
145	[ 7.990000] sd 0:0:0:0: [sda] Assuming drive cache: write through
146	[ 8.000000] sd 0:0:0:0: [sda] Attached SCSI removable disk
147	[ 8.730000] RAMDISK: gzip image found at block 0
148	[ 8.780000] VFS: Mounted root (romfs filesystem) readonly on device 1:0.
149	[ 8.800000] Algorithmics/MIPS FPU Emulator v1.5
150	[ 8.810000] Running as /linuxrc - autoscan!
151	[ 8.810000] Loading signatures file
152	[ 8.820000] 0 valid entries loaded
153	[ 13.520000] Root signature is OK.Scanner main is done
154	[ 13.540000] VFS: Mounted root (squashfs filesystem) readonly on device 8:7.
155	[ 13.540000] Trying to move old root to /initrd ... /initrd does not exist. Ignored.
156	[ 13.550000] Unmounting old root
157	[ 13.560000] Trying to free ramdisk memory ... okay
158	[ 13.560000] Freeing unused kernel memory: 176k freed
159	[ 13.790000] init: Started process: [pid=584] /etc/rc.d/rc.sysinit </dev/null >& /dev/console
160	[ 13.900000] Starting rc.sysinit
161	[ 13.910000] ?.?? : running Stage A_PreKickstart rc.Sequence_000.SourceLocalConf.sh
162	[ 13.920000] Scanning for configuration files
163	[ 13.950000] ?.?? : running Stage A_PreKickstart rc.Sequence_050.SetupCoreEnvironement.sh
164	[ 13.970000] ?.?? : running Stage A_PreKickstart rc.Sequence_075.MountProc.sh
165	[ 14.070000] 14.07 : running Stage A_PreKickstart rc.Sequence_080.SetupLoopback.sh
166	[ 14.080000] Enabling local route
167	[ 14.110000] 14.11 : running Stage A_PreKickstart rc.Sequence_100.CheckSysgen.sh
168	[ 14.140000] 14.13 : running Stage A_PreKickstart rc.Sequence_150.SetHpkImplementation.sh
169	[ 14.570000] 14.57 : running Stage A_PreKickstart rc.Sequence_300.SetHpkPlatform.Implementation_Zen01.sh
170	[ 14.810000] Invoking startup scripts for:
171	[ 14.820000] platform 'silverstreak'
172	[ 14.820000] implementation 'Zen01'
173	[ 14.820000] implementer 'TiVo'
174	[ 14.830000] default locale 'enUS'
175	[ 14.830000] version '1.0.0.0'
176	[ 14.890000] Atheros(R) AR8121/AR8113/AR8114/AR8131/AR8132/AR8152 PCI-E Ethernet Network Driver - version 1.0.1.14
177	[ 14.900000] Copyright (c) 2007 - 2009 Atheros Corporation.
178	[ 14.910000] devid 1083
179	[ 14.910000] PCI: Enabling device 0000:00:00.0 (0000 -> 0003)
180	[ 15.060000] #### Cmd line MAC address XX:XX:XX:XX:XX:XX ####
181	[ 15.060000] ##### (1) Using MAC address XX:XX:XX:XX:XX:XX ####
182	[ 15.090000] 15.09 : running Stage A_PreKickstart rc.Sequence_400.CleanupRamdiskAndStartSwap.Implementation_Zen01.sh
183	[ 15.100000] clearing ramdisk
184	[ 15.150000] 15.15 : running Stage A_PreKickstart rc.Sequence_575.Remaster.Implementation_Zen01.sh
185	[ 15.180000] 15.18 : running Stage A_PreKickstart rc.Sequence_700.CheckForPanic.Implementation_Zen01.sh
186	[ 15.210000] 15.21 : running Stage B_PostKickstart rc.Sequence_100.MountVar.sh
187	[ 15.220000] Cleanup /dev/hda9 pass 1
188	[ 15.290000] /dev/hda9 was not cleanly unmounted, check forced.
189	[ 16.050000] /dev/hda9: 67/32768 files (4.5% non-contiguous), 2261/131072 blocks
190	[ 16.090000] Cleanup /dev/hda9 pass 2
191	[ 16.120000] /dev/hda9: clean, 67/32768 files, 2261/131072 blocks
192	[ 16.130000] /dev/hda9 is clean after pass 2
193	[ 16.130000] Mounting /var
194	[ 16.150000] /dev/hda9 on /var type ext2 (rw)
195	[ 16.170000] 16.17 : running Stage B_PostKickstart rc.Sequence_101.MountVar.Implementation_Zen01.sh
196	[ 16.180000] DONT Cleanup /dev/hda9 pass 1
197	[ 16.180000] Mounting /dev/shm as TMPFS
198	[ 16.250000] 16.25 : running Stage B_PostKickstart rc.Sequence_105.SetUpZen01.Implementation_Zen01.sh
199	[ 16.260000] Zen01
200	[ 16.260000] Performing SilveStreak specific customization
201	[ 16.280000] Insmoding Zenverge kernel objects
202	[ 16.320000] znipc : Registered the Zenverge zstream driver
203	[ 16.320000] znipc : ZStream driver version - 1.1
204	[ 16.330000] znipc : built [240] Aug 13 2012,12:22:23 successfully installed
205	[ 16.340000] znipc : hpu xmem (512M) mapping: phys = 20000000, virt = c0200000, map_size 1fffffff
206	[ 16.370000] SF0: S25SL12801 detected, total 0x1000000 bytes, secsz 0x10000, nrsec 0x100, era_size 10000
207	[ 16.380000] SF1: S25SL12801 detected, total 0x1000000 bytes, secsz 0x10000, nrsec 0x100, era_size 10000
208	[ 16.390000] device znspi registered<253:0>/ clk div <4/32>/gpio_cs 0
209	[ 16.400000] SPU version before SFW reload
210	[ 16.440000] SPU SFW version: 4.18.1
211	[ 16.440000] SPU SFW build : Jul 31 2012 02:53:14
212	[ 16.450000] info, sfwdev_wait_isr ret(22)
213	[ 16.480000] SFW will load at 0x80244ec0
214	[ 16.510000] info, sfwdev_wait_isr ret(22)
215	[ 16.750000] firmware running after 21 ms
216	[ 16.750000] SPU version after SFW reload
217	[ 16.780000] SPU SFW version: 4.18.1
218	[ 16.780000] SPU SFW build : Jul 31 2012 02:43:54
219	[ 16.790000] info, sfwdev_wait_isr ret(22)
220	[ 16.810000] 16.81 : running Stage B_PostKickstart rc.Sequence_110.SetupLocale.sh
221	[ 16.910000] Set TV_LOCALE to enUS
222	[ 16.930000] 16.93 : running Stage B_PostKickstart rc.Sequence_150.CleanupVar.sh
223	[ 16.940000] Cleaning up files in /var
224	[ 17.060000] Checking space in /var
225	[ 17.100000] Mounting initial environment
226	[ 17.160000] 17.16 : running Stage B_PostKickstart rc.Sequence_200.StartLoggerDaemons.Implementation_other.sh
227	[ 17.210000] clocksane: setting clock to Fri Aug 31 20:49:24 2012
228	[ 17.340000] 17.34 : running Stage B_PostKickstart rc.Sequence_225.CheckPanicLog.sh
229	[ 17.370000] Checking Panic log
230	[ 17.480000] 17.47 : running Stage B_PostKickstart rc.Sequence_250.StartPerformanceMonitoring.sh
231	[ 17.500000] 17.50 : running Stage B_PostKickstart rc.Sequence_400.RunmePhase1.sh
232	[ 17.510000] Scanning for phase1 repair scripts
233	[ 17.540000] 17.54 : running Stage B_PostKickstart rc.Sequence_990.Diag.Implementation_Zen01.sh
234	[ 17.580000] 17.58 : running Stage B_PostKickstart rc.Sequence_995.CheckPrefixLock.Implementation_Zen01.sh
235	[ 17.590000]
236	[ 17.590000] Security Checkpoint for UN-Locked Production Units...
237	[ 17.630000] LOCKED
238	[ 17.640000] info, sfwdev_wait_isr ret(22)
239	[ 17.650000] [0] Unit is LOCKED
240	[ 18.810000] A9400XXXXXXXXXX
241	[ 18.810000] A94 is Release
242	[ 18.820000]
243	[ 18.820000] OK to proceed
244	[ 18.820000]
245	[ 18.840000] 18.84 : running Stage C_MediaInitialization rc.Sequence_400.LoadMediaDrivers.sh
246	[ 18.850000] Loading input section drivers
247	[ 18.860000] /etc/rc.d/rc.sysinit: loadInput: command not found
248	[ 18.860000] Loading output section drivers
249	[ 18.870000] /etc/rc.d/rc.sysinit: loadAllOutput: command not found
250	[ 18.890000] 18.89 : running Stage C_MediaInitialization rc.Sequence_450.NetworkKickstart.sh
251	[ 18.920000] 18.92 : running Stage C_MediaInitialization rc.Sequence_500.SplashScreen.Implementation_Zen01.sh
252	[ 18.950000] 18.95 : running Stage D_PreMfs rc.Sequence_050.SetupApplicationEnvironment.sh
253	[ 18.960000] Remote control is TIVO
254	[ 18.970000] MFS partition on /dev/sda10
255	[ 20.320000] 20.32 : running Stage D_PreMfs rc.Sequence_075.SetResourceLocale.sh
256	[ 20.350000] 20.35 : running Stage D_PreMfs rc.Sequence_150.CheckForDebug.sh
257	[ 20.360000] Look for debug board
258	[ 20.420000] 20.42 : running Stage D_PreMfs rc.Sequence_175.CheckFailedModule.sh
259	[ 20.440000] 20.44 : running Stage D_PreMfs rc.Sequence_350.CheckForPromUpdate.sh
260	[ 20.470000] 20.47 : running Stage D_PreMfs rc.Sequence_400.SetSystemClock.sh
261	[ 20.480000] Updating system clock
262	[ 20.600000] 20.59 : running Stage D_PreMfs rc.Sequence_450.SetupNetwork.sh
263	[ 20.830000] Setting TCP keepalive parameters
264	[ 20.860000] 20.85 : running Stage D_PreMfs rc.Sequence_500.LogCleanupActivity.sh
265	[ 20.900000] 20.90 : running Stage D_PreMfs rc.Sequence_525.StartProxyLauncher.sh
266	[ 20.910000] Starting launch proxy
267	[ 22.100000] Minilauncher socket ready
268	[ 22.100000] Minilauncher switching to background
269	[ 22.120000] 22.12 : running Stage D_PreMfs rc.Sequence_550.MfsMaintenance.sh
270	[ 22.140000] Checking for additional disk
271	[ 22.150000] secondary_drive is: sdb
272	[ 22.440000] 22.44 : running Stage D_PreMfs rc.Sequence_575.StartFancontrol.Implementation_Zen01.sh
273	[ 22.470000] 22.47 : running Stage D_PreMfs rc.Sequence_600.StartLauncher.sh
274	[ 22.480000] Enabling MFS active-lock debugging
275	[ 22.480000] Starting TvLauncher
276	[ 25.330000] Waiting for launcher to start.
277	[ 27.370000] Launcher is running.
278	[ 29.400000] Starting MFS daemon
279	[ 29.740000] Launcher said pid 766 exited with status 0
280	[ 29.750000] Sync Tmp LocaleCache file with database...
281	[ 30.110000] mkdir: cannot create directory '/db/sqlite_temp': Read-only file system
282	[ 30.750000] Country: US
283	[ 30.760000] Language: enUS
284	[ 30.760000] Writing 'enUS' to /var/etc/locale-cache
285	[ 30.790000] 30.79 : running Stage D_PreMfs rc.Sequence_650.CheckMfsAssert.sh
286	[ 30.820000] 30.82 : running Stage D_PreMfs rc.Sequence_750.CheckFactoryReset.sh
287	[ 30.850000] 30.85 : running Stage D_PreMfs rc.Sequence_760.CleanupAndMountDb.Implementation_Zen01.sh
288	[ 30.870000] Cleanup /dev/sda14 pass 1
289	[ 30.930000] /dev/sda14: recovering journal
290	[ 31.040000] /dev/sda14 has been mounted 8 times without being checked, check forced.
291	[ 32.680000] /dev/sda14: 34/76912 files (2.9% non-contiguous), 20494/307200 blocks
292	[ 32.720000] Cleanup /dev/sda14 pass 2
293	[ 32.790000] /dev/sda14: clean, 34/76912 files, 20494/307200 blocks
294	[ 32.800000] Mounting /db
295	[ 32.810000] kjournald starting. Commit interval 5 seconds
296	[ 32.820000] EXT3-fs (sda14): using internal journal
297	[ 32.820000] EXT3-fs (sda14): mounted filesystem with writeback data mode
298	[ 32.830000] /dev/sda14 on /db type ext3 (rw)
299	[ 32.870000] 32.87 : running Stage D_PreMfs rc.Sequence_800.RunmePhase2.sh
300	[ 32.880000] Scanning for phase2 repair scripts
301	[ 32.900000] 32.90 : running Stage E_PreApplication rc.Sequence_100.CheckHddTest.sh
302	[ 32.920000] 32.92 : running Stage E_PreApplication rc.Sequence_300.LogSystemStats.sh
303	[ 33.300000] 33.30 : running Stage E_PreApplication rc.Sequence_400.ConvertDb.sh
304	[ 33.310000] Checking for database conversions
305	[ 33.320000] Using /db for SQL database...
306	[ 33.640000] Versions match for DB_SET_Vod
307	[ 33.650000] Versions match for DB_SET_Pgd
308	[ 33.650000] Versions match for DB_SET_Http
309	[ 33.660000] Versions match for DB_SET_Temp
310	[ 33.690000] Versions match for DB_SET_Npk
311	[ 33.700000] Versions match for DB_SET_Trio
312	[ 33.720000] Versions match for DB_SET_Ldr
313	[ 33.730000] Versions match for DB_SET_Rel
314	[ 34.100000] 34.10 : running Stage E_PreApplication rc.Sequence_450.CheckForUpgradeDisc.sh
315	[ 34.110000] No upgrade to load
316	[ 34.130000] 34.13 : running Stage E_PreApplication rc.Sequence_500.CheckForSoftwareUpgrade.Implementation_Zen01.sh
317	[ 34.490000] NewSoftware: getting SwSystem name
318	[ 34.510000] NewSoftware: failure reading SwSystem master: 0x30001
319	[ 34.600000] Failed to get HPK NVMEM data store object
320	[ 34.690000] Failed to get HPK NVMEM data store object
321	[ 34.800000] HPK_PlatformGetNvmemDataStore
322	[ 34.810000] Failed to get HPK NVMEM data store object
323	[ 34.830000] 34.83 : running Stage E_PreApplication rc.Sequence_550.CheckSMART.sh
324	[ 34.840000] Performing basic S.M.A.R.T. checks
325	[ 34.850000] This can cause DriveStatusError messages in some cases... don't worry.
326	[ 34.870000] 34.87 : running Stage E_PreApplication rc.Sequence_600.PerformForensic.sh
327	[ 34.890000] No forensic selected
328	[ 34.910000] 34.90 : running Stage E_PreApplication rc.Sequence_650.CleanupPlanetX.sh
329	[ 35.610000] No preexisting PlanetX datum in DB (this is okay)!
330	[ 35.640000] 35.64 : running Stage E_PreApplication rc.Sequence_800.RunmePhase3.sh
331	[ 35.660000] Scanning for phase3 repair scripts
332	[ 35.680000] 35.68 : running Stage E_PreApplication rc.Sequence_900.PostUpgrade.sh
333	[ 35.710000] 35.70 : running Stage F_ApplicationLaunch rc.Sequence_100.CheckPerfLog.sh
334	[ 35.730000] 35.73 : running Stage F_ApplicationLaunch rc.Sequence_195.StartTranscode.Implementation_Zen01.sh
335	[ 35.740000] Starting Zenverge Services.
336	[ 37.680000] sdk_init::537, firmware load done
337	[ 38.740000] present::ghidora 0, aux0 0, aux1 0
338	[ 38.750000] platform_init::done.
339	[ 38.750000] ***** drv_revisoin: ******
340	[ 38.750000] ***** firmware revision: 86211be0a3c0 *******
341	[ 38.770000] mmap succeeded / loc_fw_start 0x2bfbc000 / z_fw_start 0x0 / size 0x1fffffff
342	[ 38.780000] mmap succeeded / loc_pool_start 0x2e589000 / ddr_pool_start 0x25cd000
343	[ 39.060000] mmap succeeded / loc_pool_start 0x30b77000 / ddr_pool_start 0x4bbb000
344	[ 39.340000] mmap succeeded / loc_pool_start 0x32fd9000 / ddr_pool_start 0x701d000
345	[ 39.620000] mmap succeeded / loc_pool_start 0x3543b000 / ddr_pool_start 0x947f000
346	[ 39.890000] SS Logging facility not initilaized! msg=<133>Aug 31 20:49:46 ssdebug:main:256 [846]: SSDebugConnectLog: connected to /dev/log
347	[ 39.920000] /platform/tvbin/zv-server: Init complete in 3s
348	[ 39.940000] 39.94 : running Stage F_ApplicationLaunch rc.Sequence_200.StartApplication.sh
349	[ 39.950000] Starting Services.
350	[ 65.700000] 31 Aug 20:50:12 ntpdate_bin[1000]: sendto(204.176.49.10): Network is unreachable
351	[ 65.900000] 31 Aug 20:50:12 ntpdate_bin[1000]: sendto(204.176.49.11): Network is unreachable
352	[ 66.100000] 31 Aug 20:50:12 ntpdate_bin[1000]: sendto(204.176.49.12): Network is unreachable
353	[ 66.460000] Initializing debug services...
354	[ 66.490000] SS Logging facility not initilaized! msg=<133>Aug 31 20:50:13 ssdebug:main:256 [998]: SSDebugConnectLog: connected to /dev/log
355	[ 66.530000] SS Logging facility not initilaized! msg=<133>Aug 31 20:50:13 ssdebug:main:344 [846]: SSDebug initialized!
356	[ 66.550000] SS Logging facility not initilaized! msg=<133>Aug 31 20:50:13 ssdebug:main:344 [998]: SSDebug initialized!
357	[ 66.560000] <133>Aug 31 20:50:13 ssdebug:main:499 [846]: SSDebugSetDebugLogLevel: debug level set to 30
358	[ 66.580000] <133>Aug 31 20:50:13 ssdebug:main:499 [998]: SSDebugSetDebugLogLevel: debug level set to 30
359	[ 66.580000] <133>Aug 31 20:50:13 ssdebug:main:518 [998]: SSDebugSetPerfLogLevel: perf level set to 100
360	[ 66.600000] <133>Aug 31 20:50:13 ssdebug:main:125 [1015]: LevelReaderThread[DEBUG]: level set to 30
361	[ 66.600000] Server started, ctrl-c to exit...
362	[ 66.620000] <133>Aug 31 20:50:13 ssdebug:main:125 [1016]: LevelReaderThread[PERF]: level set to 100
363	[ 66.620000] <133>Aug 31 20:50:13 tts-xcoder:ttsxc:1182 [998]: SW Version ssv2-CS-mips-0.1-148Y1
364	[ 66.630000] <133>Aug 31 20:50:13 tts-xcoder:ttsxc:1184 [998]: Initalizing system services...
365	[ 66.700000] 31 Aug 20:50:13 ntpdate_bin[1000]: sendto(204.176.49.10): Network is unreachable
366	[ 66.900000] 31 Aug 20:50:13 ntpdate_bin[1000]: sendto(204.176.49.11): Network is unreachable
367	[ 67.100000] 31 Aug 20:50:13 ntpdate_bin[1000]: sendto(204.176.49.12): Network is unreachable
368	[ 67.260000] Starting HTTP server
369	[ 67.380000] 67.38 : running Stage F_ApplicationLaunch rc.Sequence_300.RunmePhase4.sh
370	[ 67.410000] Scanning for phase4 repair scripts
371	[ 67.470000] 67.47 : running Stage G_PostApplication rc.Sequence_100.InvokeLateStressDiags.sh
372	[ 67.520000] 67.52 : running Stage G_PostApplication rc.Sequence_200.StartListeners.Feature_AUTHORING.sh
373	[ 67.540000] Checking For Authoring Permissions...
374	[ 67.700000] 31 Aug 20:50:14 ntpdate_bin[1000]: sendto(204.176.49.10): Network is unreachable
375	[ 67.900000] 31 Aug 20:50:14 ntpdate_bin[1000]: sendto(204.176.49.11): Network is unreachable
376	[ 68.100000] 31 Aug 20:50:14 ntpdate_bin[1000]: sendto(204.176.49.12): Network is unreachable
377	[ 68.700000] 31 Aug 20:50:15 ntpdate_bin[1000]: sendto(204.176.49.10): Network is unreachable
378	[ 68.900000] 31 Aug 20:50:15 ntpdate_bin[1000]: sendto(204.176.49.11): Network is unreachable
379	[ 69.100000] 31 Aug 20:50:15 ntpdate_bin[1000]: sendto(204.176.49.12): Network is unreachable
380	[ 69.160000] <133>Aug 31 20:50:15 tts-xcoder:ttsxc:1191 [998]: Initalizing ss crypto...
381	[ 69.180000] <131>Aug 31 20:50:15 sssys:xcmain:266 [1043]: Watchdog running
382	[ 69.210000] <133>Aug 31 20:50:15 sscrypto:sfw:282 [998]: phys_start = 0x1d5ff000, size = 0x2401000
383	[ 69.230000] <133>Aug 31 20:50:16 tts-xcoder:ttsxc:1230 [998]: Using TSN: A9400XXXXXXXXXX
384	[ 69.240000] <133>Aug 31 20:50:16 tts-xcoder:xcutil:57 [998]: Using Zenverge
385	[ 69.250000] mmap succeeded / loc_fw_start 0x2eeb6000 / z_fw_start 0x0 / size 0x18000000
386	[ 69.300000] <133>Aug 31 20:50:16 tts-xcoder:lsutil:1821 [998]: Segmenting based on RAI
387	[ 69.360000] <131>Aug 31 20:50:16 tts-xcoder:ttsxc:678 [998]: UPNP: Failed to Start (-208)
388	[ 70.100000] 31 Aug 20:50:16 ntpdate_bin[1000]: no server suitable for synchronization found
389	[ 71.370000] No Authoring permissions
390	[ 71.390000] 71.39 : running Stage G_PostApplication rc.Sequence_400.SourcePostConf.sh
391	[ 71.400000] Scanning for configuration files
392	[ 71.410000] rc.sysinit is complete in 71.41 seconds
393	[ 73.340000] HPK_PlatformGetModem
394	[ 79.380000] <131>Aug 31 20:50:26 tts-xcoder:ttsxc:678 [998]: UPNP: Failed to Start (-208)
395	[ 89.400000] <131>Aug 31 20:50:36 tts-xcoder:ttsxc:678 [998]: UPNP: Failed to Start (-208)
396	[ 99.420000] <131>Aug 31 20:50:46 tts-xcoder:ttsxc:678 [998]: UPNP: Failed to Start (-208)
397	[ 109.440000] <131>Aug 31 20:50:56 tts-xcoder:ttsxc:678 [998]: UPNP: Failed to Start (-208)
398	[ 119.460000] <131>Aug 31 20:51:06 tts-xcoder:ttsxc:678 [998]: UPNP: Failed to Start (-208)
399	[ 129.480000] <131>Aug 31 20:51:16 tts-xcoder:ttsxc:678 [998]: UPNP: Failed to Start (-208)
400	[ 139.500000] <131>Aug 31 20:51:26 tts-xcoder:ttsxc:678 [998]: UPNP: Failed to Start (-208)


If someone can post something similar for a built-in Stream from the Roamio Pro/Plus, I could do a comparison and make suggestions.
The built-in stream is more of an accessory than standalone device.


----------



## telemark

This is the running processes from a non-activated but updated TivoStream.
It's a custom format because I had to write a custom parser, 
but the # is the PID and indentation is a parent-child relation.

I believe from #2 and below, would be Kernel threads.
From #1 and below, user space.



Spoiler






Code:


1 (init) /sbin/init 
  615 (ledflasherd) /platform/tvbin/ledflasherd 
  667 (syslogd) /sbin/syslogd -p /var/dev/log -m 10000 
  669 (klogd) /sbin/klogd -x 
  752 (tivoApplication) tivoApplicationProxyLauncher 
    823 (tivoApplication) mfsd                         
    900 (tivoApplication) shmemd                       
    909 (tivoApplication) TvCryptoDaemon               
    916 (tivoApplication) SystemServices               
    939 (tivoApplication) RendezvousDaemon             
    948 (tivoApplication) KnownHostComponent           
    971 (tivoApplication) httpd                        
    984 (tivoApplication) mcp                          
    991 (tivoApplication) dbgc-mcp                     
    1001 (tivoApplication) tcphonehome                  
    1019 (tivoApplication) headlessGuidedSetup          
    1053 (tivoApplication) tts-xcoder                   
    1077 (tivoApplication) RttDaemon                    
  810 (TvLauncher) /tvbin/TvLauncher -Foreground -platform silverstreak 
  886 (minissdpd) /bin/minissdpd -i eth0 
  888 (zv-server) /platform/tvbin/zv-server -d -l -f /platform/tvbin/ 
2 (kthreadd) 
  3 (ksoftirqd/0) 
  4 (events/0) 
  5 (khelper) 
  8 (async/mgr) 
  25 (crashall) 
  174 (sync_supers) 
  176 (bdi-default) 
  178 (kblockd/0) 
  183 (ata/0) 
  184 (ata_aux) 
  185 (ksuspend_usbd) 
  189 (khubd) 
  211 (kswapd0) 
  212 (aio/0) 
  213 (crypto/0) 
  509 (mtdblockd) 
  525 (dwc_otg) 
  529 (DWC Notificatio) 
  542 (usbhid_resumer) 
  546 (krxrpcd/0) 
  552 (scsi_eh_0) 
  553 (usb-storage) 
  683 (flush-8:0) 
  759 (kjournald)


----------



## telemark

The binaries that should be the most interesting:


Code:


# cd /platform/tvbin
# ls -l
total 31042
...
-rw-r--r-- 1 6003 200 18430808 Aug 31  2012 firmware.bin
-rw-r--r-- 1 6003 200   198644 Aug 31  2012 spu.bin
-rwxr-xr-x 1 6003 200 12671968 Aug 31  2012 tts-xcoder
-rwxr-xr-x 1 6003 200   227276 Aug 31  2012 zv-client
-rwxr-xr-x 1 6003 200   255076 Aug 31  2012 zv-server

# file *
...
tts-xcoder:   ELF 32-bit LSB  executable, MIPS, MIPS32 version 1 (SYSV), dynamically linked (uses shared libs), for GNU/Linux 2.6.0, stripped
zv-client:    ELF 32-bit LSB  executable, MIPS, MIPS32 version 1 (SYSV), dynamically linked (uses shared libs), for GNU/Linux 2.6.0, stripped
zv-server:    ELF 32-bit LSB  executable, MIPS, MIPS32 version 1 (SYSV), dynamically linked (uses shared libs), for GNU/Linux 2.6.0, stripped

# strings zv-client | grep Usage
Usage: %s [-debug level]

# strings zv-server | grep Usage
Usage: %s [-f /path/to/zv_bin] [-debug level] [-d] [-n]

# strings tts-xcoder | grep Usage
Usage: %s -cryptodev dev [-fast] [-3g] [-tsfilter] [-debug level] [-perflog level] [-d]
Usage: %s <database directory>

The firmware.bin has references to this chip:
http://www.altera.com/devices/processor/nios2/ni2-index.html


----------



## telemark

I didn't see a use for this but for the sake of completeness, here's the output of a recursive MLS /



Spoiler






Code:


      FsId   Type     Name
      ----   ----     ----
        28   tyDir    BroadcastCenterConfig
        52   tyDir    DataSet
        55   tyDir    DataSetVersion
        21   tyDir    Database
        47   tyDir    GuideIndexV5
        78   tyDir    ParentalControls
        71   tyDir    Recording
        54   tyDir    Rubbish
         4   tyDir    Schedule
         3   tyDir    Server
        87   tyDb     Setup
        56   tyDir    ShowcaseIndex
        14   tyDir    SpigotMap
         5   tyDir    State
         9   tyDir    SwModule
        25   tyDir    SwSystem

BroadcastCenterConfig[28]:
      FsId   Type     Name
      ----   ----     ----
        50   tyDb     ACTIVE
        50   tyDb     TiVo-SanJose

DataSet[52]:
      FsId   Type     Name
      ----   ----     ----
        51   tyDb     BC_BroadcastCenterConfig

DataSetVersion[55]:
      FsId   Type     Name
      ----   ----     ----
        51   tyDb     24:BC_BroadcastCenterConfig

Database[21]:
      FsId   Type     Name
      ----   ----     ----

GuideIndexV5[47]:
      FsId   Type     Name
      ----   ----     ----
        43   tyFile   ChannelTable
        46   tyFile   GenreTable
        49   tyFile   Tms.index
        80   tyFile   Tms.key

ParentalControls[78]:
      FsId   Type     Name
      ----   ----     ----
        76   tyDir    WhiteAndBlackListPath

WhiteAndBlackListPath[76]:
      FsId   Type     Name
      ----   ----     ----

Recording[71]:
      FsId   Type     Name
      ----   ----     ----
        72   tyDir    Demo
        75   tyDir    NowShowingByBucketTitle
        74   tyDir    NowShowingByFlatTitle

Demo[72]:
      FsId   Type     Name
      ----   ----     ----

NowShowingByBucketTitle[75]:
      FsId   Type     Name
      ----   ----     ----

NowShowingByFlatTitle[74]:
      FsId   Type     Name
      ----   ----     ----

Rubbish[54]:
      FsId   Type     Name
      ----   ----     ----
        24   tyDb     24
        26   tyDb     26
        27   tyDb     27
        23   tyDb     23
        29   tyDb     29
        83   tyDb     83

Schedule[4]:
      FsId   Type     Name
      ----   ----     ----

Server[3]:
      FsId   Type     Name
      ----   ----     ----
        93   tyDb     11982017
        50   tyDb     163310158
        51   tyDb     163310159
        20   tyDb     254332011
         6   tyDb     254332015
        10   tyDb     254332018
        19   tyDb     254332016
       100   tyDb     23029993
       105   tyDb     522384318
        94   tyDb     522384319
        96   tyDb     522384325
       102   tyDb     522384326
        12   tyDb     93121654
        16   tyDb     93121657

ShowcaseIndex[56]:
      FsId   Type     Name
      ----   ----     ----
        58   tyFile   ShowcaseHasClipIndex.index
        57   tyFile   ShowcaseHasClipIndex.key
        53   tyFile   ShowcaseHasProgramIndex.index
        59   tyFile   ShowcaseHasProgramIndex.key
        44   tyFile   ShowcaseIdTmsIdToIdentIndex.index
        48   tyFile   ShowcaseIdTmsIdToIdentIndex.key
        40   tyFile   ShowcaseIdentToIdIndex.index
        41   tyFile   ShowcaseIdentToIdIndex.key
        42   tyFile   ShowcaseIdentToProgramIndex.index
        45   tyFile   ShowcaseIdentToProgramIndex.key

SpigotMap[14]:
      FsId   Type     Name
      ----   ----     ----
        13   tyDir    11
        18   tyDir    5

11[13]:
      FsId   Type     Name
      ----   ----     ----
        16   tyDb     mainline2
       100   tyDb     production

5[18]:
      FsId   Type     Name
      ----   ----     ----
        12   tyDb     mainline2
        93   tyDb     production

State[5]:
      FsId   Type     Name
      ----   ----     ----
        67   tyDb     ArmConfig
        84   tyDb     AvConfig
        61   tyDb     Avalanche
        63   tyDb     Cablecard
        86   tyDb     ClosedCaptioning
         2   tyDb     Database
        77   tyDb     DvdConfig
        66   tyDb     FrontPanelConfig
        82   tyDb     GeneralConfig
        35   tyDir    Keyring
        62   tyDb     LiveCacheConfig
        88   tyDb     LocationConfig
        69   tyDb     LocksLimits
        81   tyDb     Media
        85   tyDb     MyWorld
        79   tyDir    Network
        60   tyDb     PhoneConfig
        70   tyDb     PlaybackConfig
        31   tyDir    ProviderConfig
        65   tyDb     RecorderConfig
         8   tyDb     ServiceConfig
        68   tyDb     StaticConfig
       108   tyDb     StreamingClientConfig
        64   tyDb     UserInfo

Keyring[35]:
      FsId   Type     Name
      ----   ----     ----
        95   tyDb     AA_daenerys-...
        34   tyDb     BACKHAUL_PRIVATE-...
        38   tyDb     BACKHAUL_PUBLIC-...
        37   tyDb     BACKHAUL_TGI-...
        36   tyDb     BACKHAUL_THUMB-...
        39   tyDb     HM_DAK_daenerys-...
        33   tyDb     HM_DSC_daenerys-...
        92   tyDb     HM_ELOG_daenerys-...
        91   tyDb     HM_HSC_daenerys-...
        90   tyDb     SB_DAKT_baillet-...
        32   tyDb     SOFTWARE-...

Network[79]:
      FsId   Type     Name
      ----   ----     ----
        73   tyDb     004:73

ProviderConfig[31]:
      FsId   Type     Name
      ----   ----     ----
        30   tyDb     tivo

SwModule[9]:
      FsId   Type     Name
      ----   ----     ----
        10   tyDb     10
       105   tyDb     105
        20   tyDb     20
         6   tyDb     6
        94   tyDb     94
        96   tyDb     96

SwSystem[25]:
      FsId   Type     Name
      ----   ----     ----
        19   tyDb     19.0.1.RC1-...
       102   tyDb     19.1.7-...
       102   tyDb     ACTIVE


----------



## telemark

More interesting, there's a snippet in the boot scripts 


Code:


 /sbin/iptables -I block -p tcp --dport $PORT -j ACCEPT

for ports 49152, 49153, 5223, 50184.

I haven't had time to verify but it's supposedly the open ports needed by the transcoding services/daemons.


----------



## moyekj

Now that online.tivo.com exists which supports streaming video via the Stream, seems like a good opportunity to perhaps sniff out how to start a transfer via the Stream. Anyone with good network sniffing skills give this a shot? I can provide a .pem file that perhaps can be used to decrypt SSL communication (same one used for the RPC communication).


----------

