Rolling Your Own TiVo WiFi Adapter

October 14, 2020 by Tom Nardi 16 Comments

The only thing more surprising than finding out TiVo actually put out a new 4K set-top box recently is learning that somehow they didn’t bother to build WiFi into the thing. You’re forced to buy a special wireless adapter to the tune of $60 USD to add the feature. We’d make a joke about the company living in the past, but frankly, it would be too easy.

Having to buy just one of these expensive dongles in 2020 would be insulting enough, but TiVo superfan [xxbiohazrdxx] needed four of them. Rather than hand nearly $250 to the antennae-headed overlords, they decided to reverse engineer the adapter and produce their own low-cost version. While the final result might not be as slim and svelte as the original, it does come in at less than 1/4 the price.

Operating under the assumption that the TiVo would only talk to a WiFi adapter based on the same Broadcom BCM43569 chipset used in the official one, [xxbiohazrdxx] started by trying to find a standard USB dongle that might be a drop-in replacement. Unfortunately, it looks like this particular chip was almost exclusively used in proprietary applications, most commonly as a WiFi board inside of smart TVs. But as it turns out, that wasn’t necessarily a deal breaker.

After some searching, [xxbiohazrdxx] eventually found the promising CyberTAN NU361-HS board. Not only was it based on the right chipset and ran from 5 volts, but its FCC ID entry had a complete pinout for the connector. This particular WiFi module is used in a number of budget TVs and is widely available as a spare part for less than $10. By combing the board and a USB breakout PCB inside of a 3D printed case, you’ve got a plug-and-play WiFi adapter that the TiVo thinks is the real deal.

There was a time when Hackaday was flooded with TiVo hacks, but it’s now been more than a decade since cheap carrier-provided DVRs ate the company’s lunch. Realistically, there’s an excellent chance that this post will be the only time a mention of the once-mighty DVR graces the front page in 2020. While the reign of the TiVo might be at its end, the impact it had as one of the first Linux-powered consumer devices will be etched in hacker history forever.

ESP8266 Controls TiVo Over The Network

August 11, 2019 by Tom Nardi 13 Comments

Remember the TiVo? The set-top DVR that was once so popular of a hacking target that Hackaday had a dedicated subdomain for it has today largely faded into obscurity as time-shifted viewing has given way to Internet streaming services like Netflix and Hulu. But make no mistake, while the TiVo may no longer be the centerpiece of the average home entertainment center, there’s a diehard group of antennaed aficionados that are still rocking (and hacking) them.

One such TiVotee is [Thomas McQueen], who recently discovered his TiVo-powered Virgin Media V6 DVR was listening for commands on the network. After finding some official documentation for the protocol and firing off a couple of test commands from his computer’s telnet client, he realized he had an opportunity to flex his microcontroller muscle and create a library that would allow controlling the set-top box with the ESP8266 or other network-capable MCU.

[Thomas] built his project on-top of the basic Arduino WiFi library, making every effort to make it as generalized as possible so it could work on a multitude of platforms and with various targets. He even made sure to give all his functions friendly names that won’t leave users scratching their head when they read through example code down the road. We’ve seen far too many software projects that were poorly documented or obtusely programmed, so it’s always good to see somebody putting some forethought into their code.

The library makes it easy to add TiVo control to your project, but [Thomas] went one step further and came up with an example application that provides a web interface on the ESP8266 or ESP32. Any device with a web browser, such as a smartphone, can connect to the UI and fire off commands to the TiVo. His next step is to combine his library with some code to talk to Amazon’s Alexa so he’ll be able to control playback with his voice.

We’ll hand it to these TiVo users, they’re a tenacious lot. Earlier in the year, we covered how one dedicated TiVo fan managed to brute-force the child lock on his DVR using the Arduino and an IR LED.

Infrared Brute Force Attack Unlocks TiVo

January 30, 2019 by Tom Nardi 44 Comments

While the era of the TiVo (and frankly, the idea of recording TV broadcasts) has largely come to a close, there are still dedicated users out there who aren’t quite ready to give up on the world’s best known digital video recorder. One such TiVo fanatic is [Gavan McGregor], who recently tried to put a TiVo Series 3 recorder into service, only to find the device was stuck in the family-friendly “KidZone” mode.

Without the code to get it out of this mode, and with TiVo dropping support for this particular recorder years ago, he had to hack his way back into this beloved recorder on his own. The process was made easier by the simplistic nature of the passcode system, which only uses four digits and apparently doesn’t impose any kind of penalty for incorrect entries. With only 10,000 possible combinations for the code and nothing to stop him from trying each one of them in sequence, [Gavan] just needed a way to bang them out.

After doing some research on the TiVo remote control protocol, he came up with some code for the Arduino using the IRLib2 library that would brute force the KidZone passcode by sending the appropriate infrared codes for each digit. He fiddled around with the timing and the delay between sending each digit, and found that the most reliable speed would allow his device to run through all 10,000 combinations in around 12 hours.

The key thing to remember here is that [Gavan] didn’t actually care what the passcode was, he just needed it to be entered correctly to get the TiVo out of the KidZone mode. So he selected the “Exit KidZone” option on the TiVo’s menu, placed his Arduino a few inches away from the DVR, and walked away. When he came back the next day, the TiVo was back into its normal mode. If you actually wanted to recover the code, the easiest way (ironically) would be to record the TV as the gadget works its way through all the possible digits.

Back in 2004, there were so many TiVo hacks hitting the front page of Hackaday that we actually gave them a dedicated subdomain. But by the end of 2007, we were asking what hackers would do with the increasingly discarded Linux-powered devices. That people are still hacking on these gadgets over a decade later is truly a testament to how dedicated the TiVo fanbase really is.

[Thanks to Chris for the tip.]

Rewinding Live Radio

August 20, 2018 by Brian Benchoff 35 Comments

Even though it’s now a forgotten afterthought in the history of broadcasting technology, we often forget how innovative the TiVo was. All this set-top box did was connect a hard drive to a cable box, but the power was incredible: you could pause live TV. You could record shows. You could rewind TV. It was an incredible capability, that no one had ever seen before. Of course, between Amazon and Netflix and YouTube, no one watches TV anymore, and all those platforms have a pause button, but the TiVO was awesome.

There is one bit of broadcasting that still exists. Radio. For his Hackaday Prize entry, [MagicWolfi] is bringing the set-top box to radio. He’s invented the Radio Rewind Button, and it does exactly what you would expect: it rewinds live radio a few minutes.

To have a pause or rewind button on a TV or radio, the only real requirement is a bunch of memory. The TiVO did this with a hard drive, and [MagicWolfi] is doing this with 256 MB of SDRAM. That means he needs to access a ton of RAM, and for that he’s turning to the Digilent ARTY S7 board. Yes, it’s an FPGA, but actually a fairly simple solution to the problem.

The rest of the circuit is an FM receiver chip and an I2S audio codec on an Arduino-shaped daughterboard. The main controller for this project is a big red button that will simply rewind the audio stream a few minutes. There’s no telling exactly how long [MagicWolfi] will be able to rewind the audio stream, but 256 MB is a ton in the audio world.

Rolling Old School With Copy Protection From The 1980s

May 27, 2018 by Dan Maloney 47 Comments

Oh, for the old days when sailing the seas of piracy was as simple as hooking a couple of VCRs together with a dubbing cable. Sure, the video quality degraded with each generation, but it was so bad to start out with that not paying $25 for a copy of “Ghostbusters” was a value proposition. But then came The Man with all his “rules” and “laws” about not stealing, and suddenly tapes weren’t so easy to copy.

If you’ve ever wondered how copy protection worked in pre-digital media, wonder no more. [Technology Connections] has done a nice primer on one of the main copy protection scheme from the VHS days. It was dubbed “Analog Protection System” or “Analog Copy Protection” by Macrovision, the company that developed it. Ironically, Macrovision the company later morphed into the TiVo Corporation.

The idea for Macrovision copy protection was to leverage the difference between what a TV would accept as a valid analog signal and what the VCR could handle. It used the vertical blanking interval (VBI) in the analog signal, the time during which the electron beam returns to the top of the frame. Normally the VBI has signals that the VCR uses to set its recording levels, but Macrovision figured out that sending extra signals in the VBI fooled the VCR’s automatic gain controls into varying the brightness of the recorded scenes. They also messed with the vertical synchronization, and the effect was to make dubbed tapes unwatchable, even by 1985 standards.

Copy protection was pretty effective, and pretty clever given the constraints. With Digital Rights Management, it’s easier to put limits on almost anything — coffee makers, arcade games, and even kitty litter all sport copy protection these days. It almost makes us nostalgic for the 80s.

Continue reading “Rolling Old School With Copy Protection From The 1980s” →