Infrared Brute Force Attack Unlocks TiVo

While the era of the TiVo (and frankly, the idea of recording TV broadcasts) has largely come to a close, there are still dedicated users out there who aren’t quite ready to give up on the world’s best known digital video recorder. One such TiVo fanatic is [Gavan McGregor], who recently tried to put a TiVo Series 3 recorder into service, only to find the device was stuck in the family-friendly “KidZone” mode.

Without the code to get it out of this mode, and with TiVo dropping support for this particular recorder years ago, he had to hack his way back into this beloved recorder on his own. The process was made easier by the simplistic nature of the passcode system, which only uses four digits and apparently doesn’t impose any kind of penalty for incorrect entries. With only 10,000 possible combinations for the code and nothing to stop him from trying each one of them in sequence, [Gavan] just needed a way to bang them out.

After doing some research on the TiVo remote control protocol, he came up with some code for the Arduino using the IRLib2 library that would brute force the KidZone passcode by sending the appropriate infrared codes for each digit. He fiddled around with the timing and the delay between sending each digit, and found that the most reliable speed would allow his device to run through all 10,000 combinations in around 12 hours.

The key thing to remember here is that [Gavan] didn’t actually care what the passcode was, he just needed it to be entered correctly to get the TiVo out of the KidZone mode. So he selected the “Exit KidZone” option on the TiVo’s menu, placed his Arduino a few inches away from the DVR, and walked away. When he came back the next day, the TiVo was back into its normal mode. If you actually wanted to recover the code, the easiest way (ironically) would be to record the TV as the gadget works its way through all the possible digits.

Back in 2004, there were so many TiVo hacks hitting the front page of Hackaday that we actually gave them a dedicated subdomain. But by the end of 2007, we were asking what hackers would do with the increasingly discarded Linux-powered devices. That people are still hacking on these gadgets over a decade later is truly a testament to how dedicated the TiVo fanbase really is.

[Thanks to Chris for the tip.]

Rewinding Live Radio

Even though it’s now a forgotten afterthought in the history of broadcasting technology, we often forget how innovative the TiVo was. All this set-top box did was connect a hard drive to a cable box, but the power was incredible: you could pause live TV. You could record shows. You could rewind TV. It was an incredible capability, that no one had ever seen before. Of course, between Amazon and Netflix and YouTube, no one watches TV anymore, and all those platforms have a pause button, but the TiVO was awesome.

There is one bit of broadcasting that still exists. Radio. For his Hackaday Prize entry, [MagicWolfi] is bringing the set-top box to radio. He’s invented the Radio Rewind Button, and it does exactly what you would expect: it rewinds live radio a few minutes.

To have a pause or rewind button on a TV or radio, the only real requirement is a bunch of memory. The TiVO did this with a hard drive, and [MagicWolfi] is doing this with 256 MB of SDRAM. That means he needs to access a ton of RAM, and for that he’s turning to the Digilent ARTY S7 board. Yes, it’s an FPGA, but actually a fairly simple solution to the problem.

The rest of the circuit is an FM receiver chip and an I2S audio codec on an Arduino-shaped daughterboard. The main controller for this project is a big red button that will simply rewind the audio stream a few minutes. There’s no telling exactly how long [MagicWolfi] will be able to rewind the audio stream, but 256 MB is a ton in the audio world.

Rolling Old School With Copy Protection From The 1980s

Oh, for the old days when sailing the seas of piracy was as simple as hooking a couple of VCRs together with a dubbing cable. Sure, the video quality degraded with each generation, but it was so bad to start out with that not paying $25 for a copy of “Ghostbusters” was a value proposition. But then came The Man with all his “rules” and “laws” about not stealing, and suddenly tapes weren’t so easy to copy.

If you’ve ever wondered how copy protection worked in pre-digital media, wonder no more. [Technology Connections] has done a nice primer on one of the main copy protection scheme from the VHS days. It was dubbed “Analog Protection System” or “Analog Copy Protection” by Macrovision, the company that developed it. Ironically, Macrovision the company later morphed into the TiVo Corporation.

The idea for Macrovision copy protection was to leverage the difference between what a TV would accept as a valid analog signal and what the VCR could handle. It used the vertical blanking interval (VBI) in the analog signal, the time during which the electron beam returns to the top of the frame. Normally the VBI has signals that the VCR uses to set its recording levels, but Macrovision figured out that sending extra signals in the VBI fooled the VCR’s automatic gain controls into varying the brightness of the recorded scenes. They also messed with the vertical synchronization, and the effect was to make dubbed tapes unwatchable, even by 1985 standards.

Copy protection was pretty effective, and pretty clever given the constraints. With Digital Rights Management, it’s easier to put limits on almost anything — coffee makers, arcade games, and even kitty litter all sport copy protection these days. It almost makes us nostalgic for the 80s.

Continue reading “Rolling Old School With Copy Protection From The 1980s”