Day 4: Keynote: Inside Tivo

Man, I was so looking forward to this talk, Tridge (Andrew Trigell from Linuxcare), with some help from Paul MacKerras, the renowned Linux/PPC hacker, gave us an up to date list of hacks available fot the Tivo

[picture] [picture]
Because the room was pitch black during the presentation, Paul lights up Tridge's keyboard with his PPC laptop LCD :-)

While the Tivo is supposed to be a consumer proof device with a nice user interface (and it is by the way, Maddog's parents are successfully using one), it's also very hacker friendly and Tridge, with the help of a few other people, spent the several last months hacking it (to log in, type enter on the serial port 1 second after boot and the password on most Tivos is factory)

I got truly amazed when I found out that Tridge and friends, not satisfied with adding more hard drive space, soldering memory on the motherboard, reverse engineering the proprietary connector on the motherboard and turning it into an ISA bus, turning a Tivo entirely into a PAL capable device, they reversed engineered the video format, got video from the Tivo to play over the network on outside computers, figured out the TV guide database format and wrote programs to make their own database feeding for Australia through information automatically gathered by scripts on a web TV guide.
I mean these people created a new Tivo product from the existing one before Tivo, and with no technical help or docs from Tivo whatesoever.
Read on for details:

ISA bus adapter, quite handy to plug in a network card :-)

After giving a quick overview of the Tivo for people who didn't know about it (see the web site for more info and go buy one), he showed the different hacks that have been made to his Tivo, like adding more memory, more Hard Drive, and changing the Tuner module for a Pal One.

A Tivo has the following hardware:

The software is a 2.1.24 kernel with a cut down libc and very minimal tools (no ps, ls, etc...). The rest is proprietary C++ control programs (for all the video control), a TCL interpreter, and tivosh.
The Tivo being an embedded box reboots at the first sign of trouble and does other things like killing pppd every so often in case the modem didn't hang up (Tridge had to link ppp to myppp so that myppp wouldn't get killed).

It even tells you to be patient when it boots :-)

It comes with 11 partitions, most space being taken for MFS (Media FileSystem) partitions. Access to the MFS partitions is done with raw disk IO so that it can withstand unexcepted power offs. Another smart thing is that in addition to mounting root and /usr in read only mode, they have 2 root partitions so that they can update one while running from the other one. /var is just rebuilt from scratch if it wasn't unmounted cleanly.


The first challenge was to get the Tivo to work with Pal, which wasn't a given we he got the box. After finding iicdiag, he realized that most chips where also capable of Pal (with the exception of the tuner which he removed and replaced with a Pal one).

To learn more about the way things worked, Tridge edited the i2c binary module, replaced a character in the read and write functions names and made his own module which provided the function names, logged the data, and then forwarded the call to the real functions.

Tridge found specs for the Phillips 7114/7120 chips, the Micronas MSP, the IBM cs22, but the Sony CXD1922 was really hard to find.
With the docs, it was not too hard to convince the first chips that they could do PAL.
Getting to lock 1, which was the next internal level, was much harder because it required docs to CXD1922, the Sony Mpeg 2 decoder chip, which Tridge didn't have.
Eventually he ended up poking random bits at the chip until it did what he wanted and a bit later he managed to get a spec from Sony by talking to a Japanese Sony Engineer who misunderstood who Tridge was and ended up sending him a copy of the spec.

For PAL output, while Tridge did get the cs22 spec, he didn't wait for them to start poking at registers too. However, he automated the process too by feeding the output in the Tivo's input and checking the input status register to see if the input (and hence the output) has switched to PAL.

Tridge did reverse engineer their TV guide database and wrote scripts to create guide data for Australia and his home Tivo, but he's not releasing that part because it could damag their business model in the US which is to sell subscriptions to the TV guide info.

Tridge decoded the video format on disk after looking at the video sent to the device in dev and the video that was on disk.
It's now possible to play video from the Tivo on another machine over the network.
The MFS decode code he wrote hasn't been released yet as Tivo people are a bit worried about the copyright implications and infuriating the recording industry.
For now, Tridge has held on to his code while he looks at the implications.
As their MFS filesystem has been decoded, it is now possible to upgrade/replace both drives.

For the tuner, he had to remove the tuner from a BTTV card and "welded" it on the motherboard (Paul MacKerras on the other hand connected a VCR tuner board to his Tivo motherboard).


While Tivo has been friendly so far, the 2.0 version of their software is said to have more hacker countermeasures however.
While Tridge despises binary kernel modules, he does understand Tivo's dilemna a bit as apparently the only money they make is the program data subscription (I've been told that in addition to not making a penny on each Tivo being sold, Tivo is actually paying an undisclosed amount of money to Phillips or Sony for each Tivo they sell)
We'll see what happens...

You want more? Do go see the picture library for all his slides and go see the PDF he submitted too.
Still want more?

[library] Picture library [back] Back to Main Page [next] Next page

[ms free site] Email
Link to Home Page

2001/01/27 (15:00): Version 1.0
2001/01/28 (15:00): Version 1.1. Added link