I Turned a DirecTV HR54-700 into a Standalone Jellyfin Box
2 days ago
- Hacked a free DIRECTV Genie DVR (HR54-700) to run Jellyfin directly on the hardware without satellite service.
- Exploited a boot-time plugin verification flaw to gain persistent root access without modifying the read-only SquashFS.
- Bypassed the no-satellite blocking OSD (extension 775) using a diagnostic command to make menus usable.
- Used the receiver's existing 'playURL' middleware command to feed Jellyfin-transcoded MPEG-TS (H.264+AC3) into the Broadcom decoder and HDMI output.
- Built a custom C backend (hr54-jf) running on the DVR to handle Jellyfin API, Quick Connect auth, and stream relay, eliminating the need for a helper PC.
- Implemented TV UI using the DVR's old WebKit/ITV runtime with a simple remote-controlled interface (ES5, no frameworks).
- Configured Wi-Fi by reverse-engineering the proprietary vendor NVRAM object and checksum, enabling standalone wireless operation.
- Made persistence via a boot wrapper that restores services, firewall rules, and UI overlays; stock SquashFS remains untouched.
- Achieved full standalone functionality: cold boot, Wi-Fi connect, remote control, Jellyfin library search, playback with pause/seek/stop, and clean return to UI.