This is not a guide but simply the steps I took to upgrade and hack two of my Tivos. If you are a Linux person who can understand what is going on here it could save you a lot of time, but be sure to make adjustments based on your situation...

Here are the new Tivos I bought:

I got both of these working for about a week and they both upgraded to newer software before I proceeded.

Here were my goals:

  1. Add a second drive to each Tivo
  2. Add a network interface for telnet, ftp, and TivoWebPlus

Here was the extra hardware I purchased:

I could have just ordered the brackets from and found my own drives elsewhere and saved a few bucks. But I didn't want to worry about getting bad drives (which happens to me a lot) and Weaknees came very recommended as having good customer service (which they did -- I messed up my order and they fixed it right away). So, I think it was worth it. The drives they sent me had already had 'blesstivo' run on them so I did not have to do that step. Their brackets were excellent.

First, I downloaded the $5 LBA48 boot CD w/ enhancements from PTV Upgrade. This is a nice boot disk with pre-hacked kernels on it.

I also downloaded the FTP daemon onto a floppy disk.

I'm not going to go into details about removing the drive from the Tivo, but basically I removed the drive and did not touch the power supply or dislodge the cable going to the front panel.

I used the boot CD to boot a Win98 system configured as follows:

Log of activities on PC w/ boot CD

# First, backup Tivo drive onto Win98 drive
> mkdir /mnt/dos
> mount /dev/hda1 /mnt/dos
> mkdir /mnt/dos/tivo
> mkfsbackup -f9999 -6so /mnt/dos/tivo/dvito.bak /dev/hdc
Backup done!

# Now, figure out which root/boot partition is being used
> bootpage -p /dev/hdc

# Now, that means my root partition is hdc4, 
# and my kernel partition is hdc3

# Save exisitng kernel
> dd if=/dev/hdc3 of=/mnt/dos/tivo/dtivo_kernel_hdc.img

4+0 records in
4+0 records out

# Copy over new kernel
> mount /dev/hdb /cdrom
> cp /cdrom/s2_kernels/3.1.5/vmlinux.px.gz /tmp
> cd /tmp
> gunzip vmlinux.px.gz
> dd if=vmlinux.px of=/dev/hdc3

# Now, enable serial console and disable software upgrades
# (note, if this was being run from the tivo itself, the command is a bit different)
> bootpage -P "root=/dev/hda4 dsscon=true console=2,115200 upgradesoftware=false" -C /dev/hdc

# OK, now get networking working
> mkdir /mnt/tivo
> mount /dev/hdc4 /mnt/tivo
> mount /dev/hdc9 /mnt/tivo/var
> cd /mnt/tivo/etc

# Only for software version 6.2, disable the netfilter
> vi netfilter-enable
# Add 'exit 0' before the first command

> cd rc.d
> touch
> chmod a+rx
> vi


insmod /lib/modules/usbcore.o
insmod /lib/modules/ehci-hcd.o
insmod /lib/modules/ax8817x.o
sleep 15

ifconfig eth0 broadcast
sleep 60

tnlited 23 /bin/bash -login &



export TIVO_ROOT=""
export MFS_DEVICE=/dev/hda10

# start telnet
tnlited 23 /bin/bash -login &

# start ftp

# add two static routes so the tivo doesn't phone home (stops breakage)
route add -host gw
route add -net gw netmask

> chmod a+rx

# Now, copy over the FTP daemon
> mkdir /mnt/floppy
> mount /dev/fd0 /mnt/floppy
> mkdir /mnt/tivo/var/hack
> cd /mnt/tivo/var/hack
> cp /mnt/floppy/tivoft~1.mip tivoftpd.mips
> chmod a+rx tivoftpd.mips

# Make sure that in the future when we do apply an upgrade it does
# not reboot allowing us to re-hack via telnet
> cd /mnt/tivo/tvbin
> vi installSw.itcl
# Search for 'reboot' and change the command to 'exit 0'

# Now shut down and try it out
> cd /
> umount /mnt/tivo/var
> umount /mnt/tivo
> umount /mnt/dos
> umount /mnt/floppy
> umount /cdrom
> sync
> halt

I returned the hard drive to the tivo and booted it and made sure the network worked. I then removed the drive again and installed it and the new second drive on the bracket and hooked it all up. Again, I booted it and verified the drive space. Finally I shut it down once more and screwed the bracket in and closed the case.

Now, once it is up, I had to figure out which IP was assigned to the Tivo by your DHCP server (6.2) or use the static IP I assigned to it (3.1.5).

Using FTP, I transefered the following files into /var/hack:

Using telnet, I proceeded to do the rest of this:

> cd /var/hack
> mkdir bin
> cd bin
> cpio -idu -H tar < ../devbin-s2.tar
> PATH="$PATH:/var/hack/bin"
> tar xvf ../netbin-s2.tar
> mv ../ps-s2 ps
> chmod a+rx *
> cd /
> tar -xvf var/hack/vim61-s2.tar
> cd /var/hack/bin
> mv vim61 vi
> chmod a+rx vi
> cd ..
> rm netbin-s2.tar devbin-s2.tar vim61-s2.tar

# Do NOT forget to remount the drive 'ro' before you reboot!
> mount -o remount,rw /
> vi /.profile

export LD_LIBRARY_PATH=$LD_LIBRARY_PATH:/var/hack/lib
export PATH=$PATH:/var/hack/bin
export PS1='DirecTiVo ($PWD)# '
alias ro='mount -o remount,ro /'
alias rw='mount -o remount,rw /'
alias ls='ls --color=auto'
alias ll='ls -l'
alias la='ls -a'
alias lla='ls -al'

> chmod a+rx /.profile
> vi /etc/rc.d/


export TIVO_ROOT=""
export MFS_DEVICE="/dev/hda10"

export PATH="$PATH:/var/hack/bin"
( while true ; do tnlited 23 /bin/bash -login ; sleep 10 ; done ) &


echo Rebooted | /var/hack/bin/mailfile stdin 'DirectTivo Rebooted' ''
/var/hack/endpadplus.tcl 2 3 -auto >> /dev/null &

route add -host gw
route add -net gw netmask



insmod /lib/modules/usbcore.o
insmod /lib/modules/ehci-hcd.o
insmod /lib/modules/ax8817x.o
sleep 15

ifconfig eth0 broadcast
sleep 60

( while true ; do tnlited 23 /bin/bash -login ; sleep 10 ; done ) &


echo Rebooted | /var/hack/bin/mailfile stdin 'HD Tivo Rebooted' ''

/var/hack/endpadplus.tcl 2 3 -auto >> /dev/null &


> mount -o remount,ro /

> cd /var/hack
> chmod a+rx dailymail_jazz.tcl endpadplus.tcl 
> tar -xpf tivowebplus-1.X-XXXX.tar
> rm tivowebplus-1.X-XXXX.tar

Now, for 6.2 I had to make these changes to TivoWebPlus.

For the HD Tivo, I also had to make these changes to support HD local channels.

In addition to TivoWebPlus, I love DailyMail and EndPadPlus (the Plus supports my dual tuners).

I have left my phone line connected but with the changes I have made any upgrades should not be applied. Although it might keep rebooting until I do get it applied, hence the email that is sent after each reboot. If/when an upgrade comes out, my plan is to take out the upgradesoftware=false and then reboot and let it apply and then, since I commented out the reboot, I can re-hack the kernel, etc.