Installing Linux on the MSN TV 2 (RM4100)
The MSN TV 2 was an internet appliance made by Microsoft that was designed as an upgrade to the first generation WebTV/MSN TV internet appliances. It introduced broadband, support for media playback, and an upgraded browser engine based on Microsoft's Internet Explorer 6 browser. The boxes were manufactured by RCA with the model number RM4100. They're also known to be decent Linux machines, and hacking the boxes to load Linux doesn't require a lot of effort. The first, and currently, the only method for doing this was discovered by Chris Wade in 2006, which involved a 4-pin serial port attached to the RM4100 motherboard and using it to flash a patched version of the MSN TV 2's BIOS by injecting shellcode directly into RAM. This patched BIOS would load a Linux kernel from the box's CompactFlash card on boot up in place of the stock MSN TV 2 firmware. Considering that the available guides for doing this are almost two decades old and are somewhat outdated nowadays, this guide will offer up-to-date and clear instructions for those interested in turning their MSN TV 2 box into a Linux machine. MSN TV 2 boxes nowadays are pretty rare to come by, though, and since the available kernels for them are built from very old versions of Linux, you might not be able to get much out of the MSN TV 2 running Linux these days.
This guide will assume that you're using the original toc2rta Linux kernel (the one without video out support). I (the wiki admin) won't go over installing the kernel with video out support as one, the only version of that available online requires compiling the Linux source code, which I have no experience with, and two, the compiled version is no longer available anywhere. This will also assume that you'll only use the stock CompactFlash card that comes with the MSN TV 2 to flash the patched BIOS and load Linux from. It's possible to add a hard drive for extra storage if you're able to solder an IDE port onto the motherboard, but that's out of the scope of this guide. One of the steps in this guide also requires that you have a Linux or macOS system available to you or a Linux environment compatible with Windows installed on your computer, since right now there's no working native equivalent for Windows computers. I'm hoping I can find a solution for that at some point in the future.
- wtv-411
What You Need
To perform this hack, you will need:
- An MSN TV 2 (RM4100) set top box
- A tool to pry off the rubber feet from the bottom of the MSN TV 2 (i.e., a spudger)
- A computer (Right now, Linux or macOS will have to be involved at some point during this guide)
- A CompactFlash reader
- A TTL adapter - one that connects to USB is recommended
- kernel.zip and rootfs.tar.gz (Mirror)
- The patched MSN TV 2 BIOS, which loads the Linux kernel. You can download this on Archive.org at https://archive.org/details/msntv2-linux-bios.
Disassembling the MSN TV 2
Before you can get to installing Linux on the MSN TV 2, you'll have to get access to the hidden LVTTL serial port on the MSN TV 2's motherboard. To do this, you'll have to disassemble the shell of the set top box.
(The following steps have been copied and slightly edited from MSNTV 2/Extracting System Content)
Before you can unscrew anything, you'll have to cut or remove the sticker with trademark information that's conveniently placed on the right side of the back of the MSN TV 2 box, which holds the two parts of its plastic shell together and prevents it from being fully removed. Since MSN TV has long since been defunct, tampering the sticker should no longer be a concern. You can slice this sticker by the crease it holds together, or go through the tedious process of completely removing it. Whatever method you choose, the two halves of the shell will be fully separated once the sticker is dealt with and now you can finally get to unscrewing the unit.
Do you see the four rubber feet on the bottom of the unit? Underneath those are four screws that you'll have to unscrew to remove the bottom half of the box's shell. Pry off each rubber foot and then unscrew each of the four screws with a Philips head screwdriver. Now gently remove the bottom half of the shell and you'll see a metal cage with even more screws that hold the motherboard and top half of the plastic shell together. Specifically, there are 5 screws holding the metal cage: two on the left, two on the right, and one somewhere in the middle. Unscrew all 5 screws with the Philips head screwdriver, and once you're done, remove the metal cage from the top half of the shell and flip it over.
Connect the serial port
Once you've fully disassembled the shell, remove the top of the metal cage. The serial port should be at the bottom left of the motherboard and have 4 pins.
The pinout for the serial port is (from left to right):
- 1 - TX
- 2 - RX
- 3 - GND
- 4 - 3.3V
The serial port on the MSN TV 2 operates at 3.3V. You can buy a USB to TTL adapter for cheap that supports this voltage. At least in this case, the 3.3V pin doesn't have to be connected. The TX and RX connections from the adapter you're using might also have to be reversed on the MSN TV 2's TX/RX pins.
Prepare the CompactFlash card
Now take out the CompactFlash card from the MSN TV 2 and plug it into a computer. Before doing anything, I recommend you image the card in case you corrupt it and have to start over. Make sure you've downloaded kernel.zip, rootfs.tar.gz, and the patched BIOS before continuing. First, unzip all three files. In the unzipped kernel folder, copy the vmlinux.bin and cmdline files into the first partition of the card (this usually contains files for booting the MSN TV 2 firmware, such as BOOT.PRF and NK.BIN. Keep these in the partition for now). vmlinux.bin is the Linux kernel that the MSN TV 2 will boot Linux from, and cmdline is a text file containing the config for the kernel. If you're feeling adventurous, feel free to edit this file. Copy the patched BIOS from its folder, which has the filename "linux_patched_bios.bin", to the first partition with the filename "BIOS.BIN". If you're copying these files in Windows, make sure to remove the Archive attribute from vmlinux.bin and cmdline on the card as it's reported that Linux won't boot otherwise. You can do this by accessing the drive letter of the first partition in Command Prompt and running the following commands:
attrib -A vmlinux.bin attrib -A cmdline
Next, you'll have to overwrite the entire third partition of the CF card (which contains at least three folders named "Init", "Print", and "Shell") with the rootfs.img file you extracted from rootfs.tar.gz. If you have a Linux or macOS system, or if you have a Linux environment installed on Windows, it's as simple as running dd if=rootfs.img of={CF_3RD_PART}, {CF_3RD_PART} representing the device name of the third CF card partition mounted on the computer (assuming no other removable devices are connected, this is usually "/dev/sda3"). Currently, there's no known way to do this natively in Windows.
Once everything's done, put the CompactFlash card back into the MSN TV 2.
Flashing the patched BIOS
If everything's set up properly, try connecting to your serial device by using your serial terminal of choice and connecting to the COM port of your serial device at 115200 baud (Linux users can use minicom or screen, Windows users can use PuTTY. macOS users may have to perform extra steps to get their serial device recognized). You should be able to connect with no issues if your serial device is working. Now, power on the MSN TV 2 and wait for it to send # to the terminal. As soon as you see this character, immediately reply with a $. If you do this quick enough, you should end up triggering the "MSNTV Service Menu". The following text that'll be printed will look similar to this:
OK MSNTV Service Menu BoxID: xxxxxxxxxxxxxxxxxxxx Version: 1 Build: 387 MSNTV CRC: 758646167 MD5: FEC7884E 15CB25B6 8C59A9FA 4A6D0195 POST: 00
Followed by a list of commands supported by the menu. If you don't respond to the # command in time, then simply plug out the power from the MSN TV 2 and plug it back in to try again.
Once you successfully trigger the service menu, now's where the good stuff begins. In order to flash the patched Linux-capable BIOS, the people over at Toc2rta devised a method to inject shellcode into the MSN TV 2's RAM that overrides one of the service menu functions and flashes the patched BIOS from the CF card when executed. The function in particular is the video test command (v).
First, type in "x" in the terminal to go to the "Examine memory" program in the service menu. Then, copy and paste each command in the following list one by one into your terminal to fully inject the shellcode:
(The following commands will only work on RCA RM4100 units. Thomson IP1000 units use a different set of commands that we won't include here for now. A disassembled version of this shellcode can be found here)
M 4 0x0082E160 0x82E1D368 M 4 0x0082E164 0x0FEEE800 M 4 0x0082E168 0x036A0000 M 4 0x0082E16C 0x82E1DE68 M 4 0x0082E170 0xAB1EE800 M 4 0x0082E174 0xFF68FFFD M 4 0x0082E178 0x68FFFFFF M 4 0x0082E17C 0x00100000 M 4 0x0082E180 0xB286E850 M 4 0x0082E184 0xC481FFFD M 4 0x0082E188 0x00000018 M 4 0x0082E18C 0x0000003D M 4 0x0082E190 0x68117F00 M 4 0x0082E194 0x0082E1FB M 4 0x0082E198 0x000FBBE8 M 4 0x0082E19C 0x04C48100 M 4 0x0082E1A0 0xC3000000 M 4 0x0082E1A4 0x82E1E768 M 4 0x0082E1A8 0x0FAAE800 M 4 0x0082E1AC 0x00680000 M 4 0x0082E1B0 0x68000000 M 4 0x0082E1B4 0x00100000 M 4 0x0082E1B8 0x10000068 M 4 0x0082E1BC 0x21C2E800 M 4 0x0082E1C0 0x0768FFFD M 4 0x0082E1C4 0xE80082E2 M 4 0x0082E1C8 0x00000F8C M 4 0x0082E1CC 0x0014C481 M 4 0x0082E1D0 0x68C30000 M 4 0x0082E1D4 0x68742069 M 4 0x0082E1D8 0x0A657265 M 4 0x0082E1DC 0x6962000D M 4 0x0082E1E0 0x622E736F M 4 0x0082E1E4 0x73006E69 M 4 0x0082E1E8 0x74726174 M 4 0x0082E1EC 0x20676E69 M 4 0x0082E1F0 0x73616C66 M 4 0x0082E1F4 0x2E2E2E68 M 4 0x0082E1F8 0x69000D0A M 4 0x0082E1FC 0x65206F2F M 4 0x0082E200 0x726F7272 M 4 0x0082E204 0x66000D0A M 4 0x0082E208 0x6873616C M 4 0x0082E20C 0x20676E69 M 4 0x0082E210 0x63637573 M 4 0x0082E214 0x66737365 M 4 0x0082E218 0x202C6C75 M 4 0x0082E21C 0x20756F79 M 4 0x0082E220 0x206E6163 M 4 0x0082E224 0x6F626572 M 4 0x0082E228 0x0D0A746F M 4 0x0082E22C 0x00000000
Once all the commands have been entered into the terminal, type in "q" to exit the "Examine memory" program. Then, type in "v". Assuming everything's been done correctly, the MSN TV 2 should print the following text:
Running test graphics ... HW_TestGraphics hi there starting flash...
The MSN TV 2 will flicker the power and message lights back and forth while the shellcode flashes the patched BIOS. The terminal will then print "flashing successful, you can now reboot" when it's done. To reboot without touching the MSN TV 2 again, just press Enter to exit the video test, and then type in "q" to reboot the box. On reboot, the Linux kernel should boot and print to the serial terminal.
Congrats! You've successfully hacked your MSN TV 2 box to run Linux. Go crazy with it. I have no idea how useful they'd be nowadays, but now you can load whatever programs you want onto the CompactFlash card or run a server on it. Whatever you want to do to make it your own. It would definitely be cooler if a compiled video patch were still available or better yet, if a GUI distro or modern Linux kernel can be compiled to run on the MSN TV 2. This stuff hasn't gotten any attention in the past decade, so there's a lot of room for improvement. Feel free to join the WebTV/MSN TV Discord to further discuss about this topic.