PROM socketing

[joverby540]

A PROM modificiation/socket is only needed for the following models (IIRC):
* Tivo Model # TCD540040
* TiVo Model # TCD540080
* TiVo Model # TCD540140
* Humax DRT800
* Humax DRT2500
* Toshiba RS-TX20
* Toshiba RS-TX60


Justin

Does anyone know where to get the modified prom code for the 649?

[mrpenguin]

I don't think one has been released/developed yet. The prom uses some new methods. I am sure there is at least one person playing with the prom and will release something when it works.

[pianos101]

I have an S2 540040 with the latest software (7.2?) and I'm interested in updating the PROM to enable telnet, etc. I do not have the equipment or the know how to do this. If anyone is interested in doing this for me, please PM me with cost, location, etc.

Thanks!

[venkathh]

mrpenguin seems to have experienced the same problem that i am currently facing.

My post (http://www.dealdatabase.com/forum/showthread.php?t=51337) here will give you the details..

When i give a video feed, i get this error on the console repeatedly, until i pull the video feed.

error :=>
Microcode readback error expected 00000000 got 000C0000
Microcode readback error expected 00000000 got 00003000
Microcode readback error expected 00000000 got 0000FFFF
Microcode readback error expected 00000000 got 0E003C6F
Microcode readback error expected 00000000 got 00C00000

Glad to know that my BOX still has some life !! I just have to try some more options ..

Did anybody had success with this piggy back approach on a 540?

Thanks.

[djohnsto77]

Is anyone replacing the PROM for the Humax DRT400?

If so, how much does it cost?

Thanks!

[dddfdfd]

I have an R10 on order from weaknees and plan to do the prom mod on it when it arrives. I have experience on the software side (hacked a HDVR2, Linux admin, etc.) But I'm not real experienced with hardware, like modifying SMDs. I ordered the prom and socket from Sonicos, and the Chipquick kit, and plan to practice on some old boards I have around until I'm confident I can pull this off. One thing I am not sure about is the "nuts and bolts" description of what I need to do. I've spent the last few days reading the forum and I'm still not sure:

o Where is the prom in the R10? Will it be obvious when I open it up?
o Are there different mods to the firmware, or will the flash that Sonicos does cover me for whatever I want to do? I see references to lots of different releases in the forum. Is there a specific kernel I'll need to employ with specific prom image? Or does the prom mod just break the "chain of trust" and allow me to run whatever kernel I want (with, of course, killinitrd, etc.)?

Thanks for the advice

[Tropinkill]

I have SA tcd5400xx and was looking to get the prom modded, but many posts seem to end early this year (2006). Is this really necessary or has there been a software solution ?

If it is still necessary is anyone doing the modding, or know where I can purchase the parts?

I have read and searched all over but all info seems to be outdated.

[richr69]

I performed the PROM mod. This is what I did. I had a electric static bag that was big enough for the actual Tivo "motherboard". I removed the board and I positioned the board inside the bag. I then cut a openning in the bag so that the prom was accessable. I then used electrical tape and taped around the prom, isolating the prom from the rest of the board. I then proceeded to use chip-quick. It took a little time. At first I thought the bottom of the prom was glued to the board, but eventually with enough heat, I was able to slowly pry the prom off the board. I thought for sure the prom was shot, since it was hot(but it still worked when it was installed in the socket). I cleaned up the pads with a soldering wick. The socket was another challange, but with patience, a pointy soldering iron, flux and a magnifying glass, its possible.

Hope this made sense and helps.

[dddfdfd]

Thanks for the info. I have all the stuff I need to do it now. I'm going to do some practicing on some old boards this weekend. I even got the Willem prom flashing kit, but also got a flashed prom and socket from Sonicos. Did you take the center out of the socket before soldering to the board. How did the reflash work out? Do you just run whatever kernel/Tivo version you want with the killinitrd? Was this an R10?

[dddfdfd]

Can anyone tell me what software enhancements they did after the prom socket mod? Roll yer own, killinitrd, zipper, PTVnet, etc.? Any suggestions? I got an R10 modded now and it really wants to get to know my router.

Thanks

[drez]

Can anyone tell me what software enhancements they did after the prom socket mod? Roll yer own, killinitrd, zipper, PTVnet, etc.? Any suggestions? I got an R10 modded now and it really wants to get to know my router.

Thanks

I sent you a PM with some links.

[enliteneer]

I have a Tivo S2 (Model #TCD540040), running sw 8.1-01-2-540, I've read that in order to do add any enhancement hack to it, I have to replace the SST prom.

Assuming I can remove the prom, add a socket, and put a new programmed prom on it...

Where might I find the hacked prom image file? Or, alternatively can I read back the contents of my prom and just hexedit the byte(s) that need changing, and write this modified image to a new prom? From what I've read, its not many changes that need to be made, but I havent been able to find a detailed list of bytes to change. Also, Im assuming all the prom devices are the same for s2 tivos?

I read several old posts of people selling the proms ready to go, which I wouldn't mind either, but they've all stopped their services :(

TIA for any info!

[MudShark]

Yup only a cuple of bytes to change. Its the same changes as the Series 2 240xx PROMs. I thought I posted the hacked BIN file. I suggest to keep the original chip as-is and install a new chip.

I might start selling programed chips and sockets.

I have a Tivo S2 (Model #TCD540040), running sw 8.1-01-2-540, I've read that in order to do add any enhancement hack to it, I have to replace the SST prom.

Assuming I can remove the prom, add a socket, and put a new programmed prom on it...

Where might I find the hacked prom image file? Or, alternatively can I read back the contents of my prom and just hexedit the byte(s) that need changing, and write this modified image to a new prom? From what I've read, its not many changes that need to be made, but I havent been able to find a detailed list of bytes to change. Also, Im assuming all the prom devices are the same for s2 tivos?

I read several old posts of people selling the proms ready to go, which I wouldn't mind either, but they've all stopped their services :(

TIA for any info!

[enliteneer]

Thanks, I'd definitely be interested in one. The cheapest Ive seen the Enhanced Willem EPROM Programmer is for $45 and while the chip/socket might be cheap, with the s/h this whole thing will be around $60+, which I think is much more expensive than just buying a preprogrammed chip!

By the way, once the new prom is installed, is a telnet server already built-in to the original tivo software? The reason I ask is that Im looking to run an enhancement script, but it assumes that you can telnet to the tivo.

Also, anyone have an image of where on the tivo motherboard this chip is at?

Thanks!

[Jamie]

Thanks, I'd definitely be interested in one. The cheapest Ive seen the Enhanced Willem EPROM Programmer is for $45 and while the chip/socket might be cheap, with the s/h this whole thing will be around $60+, which I think is much more expensive than just buying a preprogrammed chip!There are serveral other options. If you have a series2, you can socket it and use it to dump and flash proms using homieflash.

There are cheap ide and network cards with a PLCC32 chips and software to flash proms. I use a $10 sil based ide card myself. Mine doesn't seem to have software to dump the prom though, only to reflash it.

[blickdot]

There is an image here (http://www.dealdatabase.com/forum/showpost.php?p=178031&postcount=1) It's the chip next to the battery near the IDE connector.

A socket is the way to go in my opinion.

[dddfdfd]

If you can edit the prom image, it's just a couple of small edits to prevent the verification of the hash of the prom image itself, and the kernel image. Very easy if you have the equipment to do it. It's somewhere here in the forum. It's probably easier if you can just get the modified image and just flash it into a new SST chip.

I socketed mine a few weeks ago (a dtv r10). Sonicos sent me a prom and flash, and I believe he is still offering the prom modification service. Go to dealdatabase forum -> category for sale/trade -> prom modification service.

I used chipquick to to the removal of the old prom - highly recommended. Do some practice removals first.

[mstbone67a]

chipquick is da bomb.. definetly use it!!

[V0idZer0]

I have an R10 that I want to PROM socket (or piggyback not sure which yet).

I have a few different SST39 Chips and was wondering which would work and which would not work at all.
The 39's I have are:

SST39VF010
(70-4I-NHE)

SST39LF010
(45-4C-NHE)

and

SST39VF020
(70-4C-NHE)

Does it matter which one I use? Or will they all work?

[blickdot]

The one I'm using from Sonicos is a

39VF010
(70-4I-NHE)

And it works fine on my socketed T800.

[MuscleNerd]

70ns access time is good enough, so either the '70 or '45 will do.

1Mbit is good enough, and I don't know if pin 30 (A17 on '020) is tied to anything. So it's safer to go with '010 unless you know pin 30 is tied off.

And if you have 'VF, might as well go with them instead of 'LF because lower voltages are okay with that variation.

So with all the above considerations, the "safest" one to use is SST39VF010

[V0idZer0]

I bought a few different ones because Im trying doing the Piggyback double socket mod. So far I have been unable to get it to work. Im using the SA2.5HackedBin that was posted. I have clipped Pin 24 on the old prom and made the socket exactly as listed in jmayes guides. With any of the new chips clipped on using either a hacked 2.5 Bin or an unhacked 2.5 bin and all I get is a black screen.
If I remove the socket and leave the original proms pin 24 UNHOOKED it works and I get the "welcome powering up screen". I have checked my socket twice with a multimeter to verify all the pins are connected between the two sockets and everything checks out. Is there anything else I can try? Or something I messed up?

[crashHD]

I had the exact same problem as VoidZero. In my case, it turned out to be poor solder joints. Those tiny SOB's are difficult to solder, even with the bottom of the socket knocked out. Mine would test good for continuity (every pin, twice), but when I installed the chip, a few pins would loose contact. My guess is that installing the chip pulled apart the contacts on the pins with poor joints.

My R10 (series 2.5) did the exact same thing...would boot with pin 24 disconnected. I don't know how many times I scratched my razor over that trace, thinking it was the problem, thinking if it still booted that meant surely that trace was not broken (even with negative test for continuity).

My suggestions:
(1) Use good sockets. I used cheap ones, because I could got 30 or so on ebay insanely cheap. The legs on mine were not bendable. It made this much more difficult. Don't use cheapies...just don't do it...too much frustration.
(2) Check for continuity with the new prom already in the top socket. From the underneath side, put one lead against the chip foot, and the other on the empty sockets connector. That way your testing for continuity all the way through. In my instance, that was how I figured out installing the chip was causing the poor joints to give.
(3) When doing (2), touch your tester leads as gently as possible. When testing mine, any sort of pressure applied to the contacts pushed them enough for the bad joints to make contact, yielding a false positive test for continuity. Just drag your testers probe over the contact with a feather's touch, and you'll find your bad connection(s). This is best done with a tester with an audible beep function.

[avpman]

Ok, from the rumor mill Kraven has stopped doing them? If so, I'm game to pick up where he left off. Have SMD reworkstaion and not affraid to use it. :)

If Kraven is still doing them, I have *NO* intentions of stepping on his feet!!

I currently only have the SA-2's firmware. So for the Direct Tivo people, and the HD Tivo people I need at least links to the 'enhanced' firmwares.


Are you able to provide a service to remove the same chip from the S3's and replace with a socket? I can probably get the replacement chip programmed on my own.

However, I also want to make sure I can reinsert the original chip or an exact code equivalent.

[mumcs01]

I know its been posted that many people have used cheap ethernet and HD controller cards to read/write these PROMs. I have a controller card that has one of these that I was able to socket, but I'm unsure of how to READ the original image off of a PROM with this method. The utilities these controllers have can write, but not read. Anyone have experience with this?

[mrpenguin]

(See other thread you asked) (http://www.dealdatabase.com/forum/showthread.php?p=274806#post274806)

[Ndn guy]

i seen the stacking method and the regular just take out the old PROM and install new one. Which method do you think is better? Also when completed will it boot normally or will i have to do some programing. My friend and i are having trouble removing the old PROM we have use Chipquick and read that you have so go over the pins a couple of times to slide off. Can anyonw help?

[PlainBill]

i seen the stacking method and the regular just take out the old PROM and install new one. Which method do you think is better?
I would prefer to remove the chip and solder a socket in it's place. That way you can pop the old prom back in and verify you did it right. Also when completed will it boot normally or will i have to do some programing.If you did not damage the original chip when removing it, and have properly soldered in the socket, you can just pop the original chip into the socket and it will work with the unhacked drive. Popping in a prom with the signature check disabled will also work with an unhacked drive. My friend and i are having trouble removing the old PROM we have use Chipquick and read that you have so go over the pins a couple of times to slide off. Can anyonw help?
Go over the pins several times with chipquik, then you will have to maintain enough heat on ALL the pins before you can slide the chip off. A hot air gun used CAUTIOUSLY will be a big help.

PlainBill

[Ndn guy]

I've seem to be having some trouble after replacing the PROM when we turn on the R10 the hard drive spins but we don't see the power (green) light go on in the unit. We checked everything carefully and do not see anything fuses or Caps blown out. We also get no picture on the screen, can anyone let us know what went wrong? Also the fan in the back is not spinning as well. I've checked to see if the prom was getting power by looking you the diagram and using a multimeter. The PROM is getting power and still no picture and no power light.

[Narf54321]

You've most likely got a bridge or a cold joint somewhere. Try to clean out the contacts with some copper braid and go over all the pins again. You can check pin-to-pin with your meter as well to make sure there's some resistance in all of them.

Otherwise, you'll need to remove the socket and try again. Be careful not to pull up any pads.

[Ndn guy]

Also since i have an r10 when i do get the chip to work, will i get a normal sunrise screen or do i have to set everything up again?

[Omikron]

Also since i have an r10 when i do get the chip to work, will i get a normal sunrise screen or do i have to set everything up again?

Once you get your chip working again, everything should be exactly as you left it.

[Ndn guy]

I'm still having trouble with this i didn't use the PLCC-32 SMT socket even though i have one. I've checked the so see if the chip is getting power using a multimeter, and i still get a blank screen. So I'm wondering is my chip bad? or not pre-programed like the guy where i bought from said it was. If so how can i program the PROM chip?

[mrpenguin]

I assueme you are sure it is mounted correctly (pin 1 lines up)
no lines or traces are cut?

was this the original prom reprogrammed, or a new prom? does the orig still work?

I used an IDE controller to program my prom.

[Ndn guy]

the original works,and no lines or traces are cut. i was told the PROM i installed was programed. So i don't know how to check if it is, where can i get an IDE controller and where could i find the software to program the PROM.

[mrpenguin]

its a bit tricky.

First, whatever card you use, you will need to either socket it or solder/desolder your prom. Then use the sw that the controller uses to upgrade its firmware, just substitute the tivo fw file instead.

Honestly, sockets help a bunch for this. I just wonder, could they have put fw on the chip, just not the right one for your tivo model? Either way it don't work and that is the issue.

[Narf54321]

I'm still having trouble with this i didn't use the PLCC-32 SMT socket even though i have one. I've checked the so see if the chip is getting power using a multimeter, and i still get a blank screen. So I'm wondering is my chip bad? or not pre-programed like the guy where i bought from said it was. If so how can i program the PROM chip?

Sounds like you have a classic case of a short or incomplete trace on one (or more) pins.

Did you say you did or did not have a socket in place? Now you see why we always recommend doing a socket.

[Ndn guy]

here's pic of how the chip is placed. Sorry about the pic begin blurry my camera can't get in close to give details, so this is the best shot i have. i have more also blurry if you want

http://img140.imageshack.us/img140/6319/03132007004rz9.jpg

[buechel]

when you plug in the power supply does the cooling fan spin?

try pulling the battery and powering the device (if it works put the battery back in after unplugging again)

use your meter to check for shorts between every single pin and corner pins. I suspect a short. Too bad you didn't use a socket!

Where possible use the multimeter to check continuity to the trace (check where the trace goes through the PCB and copper is exposed.

[Ndn guy]

no the cooling fan does not spin. Can i just try it again using the socket?

[Omikron]

You can certainly try again, but only if you're confident in your soldering abilities. Those contact pads can be sensitive to excessive heat and if you mis-solder something, then you could easily be causing further damage. If you try to go it alone once more, use only the absolute lowest temperature required to melt the solder, go slow, and use flux. Otherwisie, if you want to try a different chip or have someone do it for you, check out the PROM threads in the Buy/Sell/Trade forum.

[buechel]

The cpu isn't getting instructions from the prom. This could be one of two reasons.

1. bad soldering (either cold joints or bridged joints)

2. bad chip (either no programming or programming for the wrong tivo model)

Simply put without putting a socket in so you can not definitively tell which it is. Socket the chip and when you can make the unit boot using the original chip (and only then) are you in a position to judge if the new chip is correctly programmed.

[Ndn guy]

My friend who works with circurt boards as a living got the socket on and when we plugged the PROM chip in still nothing. I even put in the old PROM chip with the same result. we checked the pins on the board so the PROM should be getting power but still nothing.

A blank screen now power light on and the fan is not spinning with the battery and without. So what do you guys think? is the whole board shorted? is it fried? man i really miss my Tivo and want to know should i be looking for another R10 now. here are some pictures of the socket after installation. By the way i live in LA and if anyone know how to fix this i will be willing to drive to get it done. thanks

http://farm1.static.flickr.com/154/428472452_f3a37b3ed7.jpg?v=0

http://farm1.static.flickr.com/188/428472437_4cba105a5b.jpg?v=0

[mrpenguin]

yeah, I think it may be gone. It could be something else got shorted or melted during your swap. I had one go this way too. It may be something else, but I doubt it. Sorry.

[Narf54321]

You can't really tell much from a photo. I've had a couple which looked good, but ultimately didn't work. I was able to resuscitate them both, one of which was an $800 Series-3 board (Whew!) so my impression is that the Tivo boards can sometimes be pretty hardy.

I've always tried to work on them in the original case. Removing the entire board seems asking for trouble, as you are much more likely to bow or flex the board and kill it. Also, I've had an original PROM die on me during heat-blast removal, so I'd check your chips in a reader if you have one handy.

An ohm meter check against all the pins can really help determine if there are further shorts or non-contacts. OTOH, how much is a new R10 these days?

[MudShark]

Redo the socket. Watch CLOSELY for solder bridges. I assume he use solder paste and not a roll of solder?


My friend who works with circurt boards as a living got the socket on and when we plugged the PROM chip in still nothing. I even put in the old PROM chip with the same result. we checked the pins on the board so the PROM should be getting power but still nothing.

A blank screen now power light on and the fan is not spinning with the battery and without. So what do you guys think? is the whole board shorted? is it fried? man i really miss my Tivo and want to know should i be looking for another R10 now. here are some pictures of the socket after installation. By the way i live in LA and if anyone know how to fix this i will be willing to drive to get it done. thanks

http://farm1.static.flickr.com/154/428472452_f3a37b3ed7.jpg?v=0

http://farm1.static.flickr.com/188/428472437_4cba105a5b.jpg?v=0

[Ndn guy]

Redo the socket. Watch CLOSELY for solder bridges. I assume he use solder paste and not a roll of solder?

no he used a roll of solder, man the weirdest thing is that we checked everything and nothing looks like it got shorted, could is possibly be that the chip got shorted during installation?

[Ndn guy]

You can't really tell much from a photo. I've had a couple which looked good, but ultimately didn't work. I was able to resuscitate them both, one of which was an $800 Series-3 board (Whew!) so my impression is that the Tivo boards can sometimes be pretty hardy.

I've always tried to work on them in the original case. Removing the entire board seems asking for trouble, as you are much more likely to bow or flex the board and kill it. Also, I've had an original PROM die on me during heat-blast removal, so I'd check your chips in a reader if you have one handy.

An ohm meter check against all the pins can really help determine if there are further shorts or non-contacts. OTOH, how much is a new R10 these days?

it wasn't any trouble removing the board actually that's how he did the soldering i don't have a chip reader, know of where i can get one to make sure. also what brand and model suggested?

[Omikron]

it wasn't any trouble removing the board actually that's how he did the soldering i don't have a chip reader, know of where i can get one to make sure. also what brand and model suggested?

If you just want to make sure that your PROM chips are okay, you can send them to me. I have a fairly nice unit (http://www.dealdatabase.com/forum/showthread.php?t=53722) that I can read/write with but any basic programmer would work I suppose. If you're interested, send me a PM.

[pentium101]

You can check for proper chip orientation. In other words, make sure pin 1 is going to where pin 1 should on the motherboard.

[buechel]

if an ohm reader doesn't show any shorts then you likely have a cold solder joint. Other problems include:

- both proms are bad, but maybe for different reasons (one killed on removal and the other set for the wrong tivo). Check the proms themselves for anything shorting the pins etc.

- removing the board flexed something else loose

- very unlikely, chip orientation is wrong.

- I notice a lot of bent caps and some loose solder on the PCB. this suggests sloppines, which a job like this has no tolerance for.

Unless you have very good pictures I can't tell anything from photos. We are looking for flaws which are difficult to see in person under good light without magnification.

[Ndn guy]

Well i took out my board to get a better shot of the chip and when i was putting back together i notice that the front ribbon was having trouble getting in the slot. so after i blew into it i put in then i turned it on just to check and everything now works. So thank you guys for your help i guess it was that ribbon the whole time. also one last question, i did do the new update on the r10 i still plan to put in a larger HD, will the new update affect the size o the hd? By the way i'm going to install a (Seagate barracuda 7200.7 200 gb)

[mrpenguin]

Oh Man! that is awesome! big ol' sigh of relief, eh? cool deal. The update = new tivo ver? if so, that does not change the size of the drive, the updates go in one area, the shows in another.

[tivosohn]

I just want to share a little experience for resolving the problem of after you soldered the PROM and the fan doesn't come up and nothing shows on the TV.

After hours of debugging this problem and I was dead worry thinking that my $300 tivo has became a door stopper. But it WASN'T! :D Basically this is what I found out. When I pull the PROM and replaced it with a new one. It just happens that the damn battery is weak, it has a reading of 2.83V on my digital meter. So, I went and picked up a new battery. Everything worked like a charm. One thing I noticed is this. Somehow the battery seems to work like a regular PC, besides running the clock and verify the PROM instruction cached somewhere outside the PROM for a faster launching. So, if both the external power is turned off and the internal cache is being reset by a bad battery or removal of the battery. The CPU will not know what to do and halted everything. Once you replaced the battery with a full power, when you plug-in the external power, it takes like 3 to 5 seconds for the PROM to load the basic machine controlling instruction to the CPU and the fan starts spinning at that time. After that, without removing the battery, every time I disconnect the external power or swapping the PROM. Everything will launch up without the the 3 to 5 seconds delay.

[tivosohn]

By the way, I have a question. If I can boot up the machine to the state of able to record shows and sometimes when I reboot, the screen flickers and stay black. Could this be caused by a bad soldering? Or what could have caused this?

[Narf54321]

You might have a cold solder joint or something, which works when the machine is cool but then fails once warm. Or something.

You might have to start over with your socket. That sucks. At least the Tivo motherboards tend to be pretty hardy.

[tivosohn]

I am quite new to soldering world. What exactly does it mean when people said "cold solder joint"?

[Omikron]

I am quite new to soldering world. What exactly does it mean when people said "cold solder joint"?

http://www.google.com/search?q=cold+solder+joint

[mcflyss29]

Sorry if this is not the correct place to post but can someone tell me what models tivo SA can have a hack. just got a TCD540080 and read you have to due a eprom replacement. It this true? Thanks in advance.

[ScanMan]

Sorry if this is not the correct place to post but can someone tell me what models tivo SA can have a hack. just got a TCD540080 and read you have to due a eprom replacement. It this true? Thanks in advance.Older SA Series 2's with TSN's that begin with "140" and "240" can be hacked with a software mod (killhdinitrd). The "540" and newer tivos (DT, Humax, Toshiba) have improved security features that foil killhdinitrd and thus require a hardware mod, i.e., EEPROM replacement.

[mcflyss29]

thanks for the quick response so basically I would need a replacement eprom? arrg. Thanks for your help! :mad:

[tivosohn]

Finally, after almost 3 weeks with around 10 to 12 resolders and fixed 5 pulled soldering pads, I finally get this baby to come up in every reboot. I will let this run for a couple of days to see how stable it is. What a nightmare for fixing those pulled pads. Thanks for the tips everyone.

[Narf54321]

Five pads?!!

Talk about a challenge! Good job, tivosohn!

[Omikron]

Five pads?!!

Talk about a challenge! Good job, tivosohn!

Only five? Bah! I've seen a photo of someone lifting no less than 11 pads from a Series3...

If I get permission from them I'll post it. ;-)

[tivosohn]

Only five? Bah! I've seen a photo of someone lifting no less than 11 pads from a Series3...

If I get permission from them I'll post it. ;-)

Holy craps! 11 pads? *LOL* That sure is a disaster, I hope this person found a cheap way to repair them like myself instead of having to spend like another $60 to $150 to buy the professional soldering pad repair kit. :) I should have paid the extra $5 at Fry's electronics to get that chips removal kit for removing the original chip to start with. :)

[Soapm]

I should have paid the extra $5 at Fry's electronics to get that chips removal kit for removing the original chip to start with. :)

Thanks for the advice, I just ordered the chip removal kit from Fry's. Do you think this solder paste will work? http://shop3.outpost.com/product/2754933

it says it's silver but doesn't specify it works for SMD.

[tivosohn]

Thanks for the advice, I just ordered the chip removal kit from Fry's. Do you think this solder paste will work? http://shop3.outpost.com/product/2754933

it says it's silver but doesn't specify it works for SMD.

Dude, that one is for soldering, not desoldering. That one is for soldering something without using the heat. What you need is this or something like this:

http://shop3.outpost.com/product/2644632?site=sr:SEARCH:MAIN_RSLT_PG

[mrpenguin]

I just want to share a little experience for resolving the problem of after you soldered the PROM and the fan doesn't come up and nothing shows on the TV.

After hours of debugging this problem and I was dead worry thinking that my $300 tivo has became a door stopper. But it WASN'T! :D Basically this is what I found out. When I pull the PROM and replaced it with a new one. It just happens that the damn battery is weak, it has a reading of 2.83V on my digital meter. So, I went and picked up a new battery. Everything worked like a charm. One thing I noticed is this. Somehow the battery seems to work like a regular PC, besides running the clock and verify the PROM instruction cached somewhere outside the PROM for a faster launching. So, if both the external power is turned off and the internal cache is being reset by a bad battery or removal of the battery. The CPU will not know what to do and halted everything. Once you replaced the battery with a full power, when you plug-in the external power, it takes like 3 to 5 seconds for the PROM to load the basic machine controlling instruction to the CPU and the fan starts spinning at that time. After that, without removing the battery, every time I disconnect the external power or swapping the PROM. Everything will launch up without the the 3 to 5 seconds delay.

I have to say, THANK YOU! I did another socket job today and I knew I did it correctly, but the dang fan didn't spin. I had another that I tried to piggie that had the same issues, but I figured it was a line cut as well and overheating boards, etc. But this one, I knew I didn't do any of that. Well, pulled out a new 2032 battery, popped it in with a chip in the socket, bamn! it worked! I honestly would never have believed it if I didn't see it. Now to try out that other one I left for dead!

[AlphaWolf]

Has anybody tried cutting away the solder joint underneath pin-24 instead of cutting the trace? I am curious if this can be done successfully without applying too much heat. If so it would be an easy thing to patch back up should you ever want to undo the mod.

I am tempted to try this on a dead tivo I have, but I can't remember where I put my xacto knife kit...

Basically something along these lines is what I have in mind:

http://www.hobbylinc.com/htm/hca/hcahcar0770.htm

Or do you bear too much of a risk at lifting the pad with something like this?

[Omikron]

Has anybody tried cutting away the solder joint underneath pin-24 instead of cutting the trace? I am curious if this can be done successfully without applying too much heat. If so it would be an easy thing to patch back up should you ever want to undo the mod.

I am tempted to try this on a dead tivo I have, but I can't remember where I put my xacto knife kit...

Basically something along these lines is what I have in mind:

http://www.hobbylinc.com/htm/hca/hcahcar0770.htm

Or do you bear too much of a risk at lifting the pad with something like this?

I would all but guarantee that you're going to lift the pad via your method. That said, it shouldn't be too difficult to simply apply heat to that pin only with an average soldering iron, and then use an xacto knife to lift the pin. The appropriate amount of heat is absolutely requisite though, no matter what your method.

[AlphaWolf]

I would all but guarantee that you're going to lift the pad via your method. That said, it shouldn't be too difficult to simply apply heat to that pin only with an average soldering iron, and then use an xacto knife to lift the pin. The appropriate amount of heat is absolutely requisite though, no matter what your method.

Hmm...could lightly tin it with chipquik I suppose before putting the blade to it, make it a little easier.

[AlphaWolf]

Here's a thought: Would it be that dangerous to reprogram the prom without removing it and without cutting any traces? Except perhaps, the trace that the +10v needs to be applied to, as IIRC this isn't the same trace that is used for normal +5v for reading the prom at bootup.

Namely, thinking along the lines of a programmer that you can just plug on top of the PLCC while the tivo is off, connect to your PC, and flash.

I've seen diagrams for programmers that cost roughly $30 to build from buying the parts separately. If mass produced, I would imagine this can be done cheaper, could even be marked up to say $40, and it would easily be universal for all SST37 tivos so you'd only need to buy one. Maybe even add a switch for SST39 to make it universal for all tivos period. No worrying about a bad flash or messing around with pulling it out of the socket. If you screw up just do it again.

[PlainBill]

Here's a thought: Would it be that dangerous to reprogram the prom without removing it and without cutting any traces? Except perhaps, the trace that the +10v needs to be applied to, as IIRC this isn't the same trace that is used for normal +5v for reading the prom at bootup.

Namely, thinking along the lines of a programmer that you can just plug on top of the PLCC while the tivo is off, connect to your PC, and flash.

I've seen diagrams for programmers that cost roughly $30 to build from buying the parts separately. If mass produced, I would imagine this can be done cheaper, could even be marked up to say $40, and it would easily be universal for all SST37 tivos so you'd only need to buy one. Maybe even add a switch for SST39 to make it universal for all tivos period. No worrying about a bad flash or messing around with pulling it out of the socket. If you screw up just do it again.

In theory, this may be possible. I'd have to see a detailed schematic before I'd be willing to try it. You'd want to hold the CPU in the initial reset condition (all outputs floating).

PlainBill

[MuscleNerd]

To program the SST37 you've got to apply 12V to its /OE and A9 pins, both of which probably connect to the CPU directly (possibly through buffers though). Driving 12V onto those signals would be a very mean thing to do to the CPU.

Beyond that though, you've got to drive its /WE pin low. That pin is almost certainly tied directly to VDD on the board (I haven't verified this), so you'd basically be trying to connect the power supply to ground. That would be a very mean thing to do to yourself.

[rc3105]

yep, without cutting trace(s) that 12v finds it's way to other components and releases the magic blue smoke (http://en.wikipedia.org/wiki/Magic_smoke) which modern electronics rely on

[AlphaWolf]

yep, without cutting trace(s) that 12v finds it's way to other components and releases the magic blue smoke (http://en.wikipedia.org/wiki/Magic_smoke) which modern electronics rely on

Yeah I accidentally let some of that stuff out of a tivo power supply once. The receptacle for the power cord on the back of the tivo isn't meant for many removals/reinsertions, apparently.

Very similar to the first generation xbox actually, which microsoft so courteously provided a nearly useless circuit breaker for. But I tend not to render my xbox unbootable as often as I render my tivo unbootable, so it survived longer.

[duppa43]

OK guys, I admit to being ultra new to Tivo hacks. But I am a long time XBOX and FTA hacker. I don't mind spending the time reading to figure out how to hack my new Tivo, but I'd like one answer that I cant seem to find for sure.

I have just spent many hours reading these fourms, and I cant figure out exactly , if my unit is the 2.5 or the 2 and where I need to start. I recently purchaced a tivo at BigLots, it has USB, it is model TCD649080, I am not sure what a nightlight is!!! my unit front is silver with a large black insert in the middle with the Tivo icon, and a small green light. It is supposed to be Dual Tuner 80 hour unit. Can I hack this unit? If so, do I need to mess with the PROM?

if someone could kindly answer these two questions, I can better direct my reading! thanks so much in advance

[Narf54321]

duppa43, yes your Dual-tuner TCD649 needs a PROM mod to "hack".

The boot PROM first checks the hard drive and linux kernel to make sure it is Tivo(tm) "official" and then passes boot control to the kernel. Then the initrd process inside the kernel checks the root system software for any stray or unofficial files and wipes out any which don't belong. So, to "hack" you need to defeat both issues beginning with the PROM kernel checks.

Usually this means removing the PROM chip, installing a PLCC32 socket, and then inserting a new chip with slightly modified PROM code to defeat the kernel check.

[jt1134]

http://dealdatabase.com/forum/showthread.php?t=50973

[digdug]

Would a SST 49LF020 33-AC-NH work? My ASUS mobo has one. Looking at the data-sheet, it says LPC but also support Parallel Programming mode. However, the address pins doesn't seem to match properly. Thoughts?

[MuscleNerd]

Sorry, that is definitely not a drop-in replacement for 37VF010. Among other things, most of the control signals are on the wrong pins.

[digdug]

I ended up purchasing the SST39VF010-70-RI-NHE at mouser.

For an EEPROM writer, I picked up a used Intel PRO/100B for $5 at a used computer store and used the Intel program FBOOT (I was unable to get Intel's IBAUTIL, UNIFLASH, or HOMIEFLASH to work correctly. FBOOT was hard to find, you have to google for FBOOT.EXE) to write the flash. If you use an Intel NIC, you will want one with the 82557 LAN Chip since it can write up to 1MB and is recognized by FBOOT. I wasted about 2 days with an older Intel PRO/100A that has the older 82566 chip that wouldn't work with any of the programs listed above.

To use FBOOT to write your modified PROM, let the program backup the existing flash to a file. Then, rename that file to *.bak and rename your modified TIVO prom to name of the backup flash filename. Then, do a RESTORE. Luckily for us, there is no checksum.

I popped the flash rom back into my newly socketed TIVO and it booted up like a champ (I put together a little write-up of my PROM replacement if anyone is interested).

Only bummer so far is that Superpatch doesn't support my tivo version 7.2.0a-oth-01-2-540.

[bigt112511]

So after reading almost all of the prom socketing posts, I have not seen much talk about techniques and physical pictures of socketing a TCD540080 series 2.5 tivo. I have seen pics from jmayes from posts 172 and 168. I am attempting to piggy-back and im stuck on soldering a wire from the boards 24 socket eye-lit to the piggy back. In the attached pic, the yellow arrow pointing to what i consider pin 24's eye-lit, which i found with a continuity tester (note the cut of the line to 24). I bought some chip quik for maybe a future attempt of socketing the board. I used the flux on the 24 eye-lit and let it sit for a min and wiped it off and then wiped it down with 70% rubbing alcohol. The wire I am attempting to use is H-JMPLED that i bought from fry's (a piece of wire like 2 inches long). I know it is not copper but I thought it would work. My soldering iron is a 60W little under 900 deg iron by ecg. Seems like I now know that it is probably to hot for what i need to do. My piggy-back has half the pins bent outside and half in, so soldering could be a bit easier on me since i am a newbie at it. I have checked all the connections via a continuity tester and they all check out. On the piggy, at pin 32, the top and bottom are soldered together with a h-jmpled wire coming out of it and terminating on the lower piggy's 24 pin. The upper 24 pin has a wire waiting to go to the board. I am attempting to solder a wire to the board first, then make a final solder to the wire sticking out of the top 24 pin, to make things easier. When I attempt to solder to the board, I have held the wire on top of the eye-lit and attempted to solder it to the board, but it just seems to pop right off. I clean the area and try again. The wire is just slightly bigger the the eye-lit hole, so when I place it on the hole there is not to much metal showing, and maybe that is causing it not to fuse to the board? Any tips on how you do it. What wire are you using? Please be specific as possible on your techniques and criticisms. Especially tips on how to make such precise solders on very small areas. Later on after I improve, I might try socketing the board and I am curious how you are able to solder to the right of the chip near the IDE plug and get such precise solders. I was thinking of maybe getting some solder-it paste that comes in the syringe and putting a small amount on the connections and just tapping them with the head and presto?? Also a few posts back people have also had problems with the piggy and mentioned that the tivo still booted even though the line to the 24 eye-lit was cut. My 540 also boots with the 24 line being cut, and Im wondering if anyone has any input on this? I have yet to actually set the tivo up with a subscription, but it does get to the initial setup screen. Thanks.

[mrpenguin]

My tip on how = if you are going to do that much work, just socket the chip and be done, the piggie just never seemed to work consistantly and more work in my experience. Your arrow looks to be in the proper place if I remember correctly. Best of luck.

[Neosum]

Has anyone ordered from this page?
http://www.mastersav.com/Tivo_Prom.html

I think I made a mistake of placing an order and making payment. The guy's not responding to my emails and I received no notification of when/if my prom would be shipped.

Anyone know any other reputable sources to buy a flashed prom for the tcd649? I made a post in the for sale forum.

[Roger Dylan]

I think I made a mistake of placing an order and making payment. The guy's not responding...Anyone know any other reputable sources to buy a flashed promIf you'd made any effort before posting, you'd have seen that he's been ill and promises to catch up as soon as he can.

[Neosum]

I didn't know that was the same guy that posted here... is it? If it is, that'd be a relief since I found the site through google and not through this forum. Thus, not linking the two as the same person.

[ScanMan]

I didn't know that was the same guy that posted here... is it?I believe it is. The pictures/prices he posted are the same as the ones posted here. Only he knows for sure though. :D

[Neosum]

The price on that website was $3 more for the DIY kit. I hope it's the same guy, cause if it's not, the other guy isn't responding... :(

And I made every effort to read as much as I can here, so that comment about not making any effort wasn't neccessary. I've done nothing but read for a week before even registering.

[labbie48]

Pretty sure he's cutting the members here a break.

[Neosum]

Is anyone else selling DIY prom kits? I looked around and definitely do not want to buy a programmer (or make one) just to replace one box.

I do have a bunch of old computer parts sitting around if I could figure out how to use them as programmers. A few network cards, ide controller cards, 2 old mother boards, an old video card and more. I've been practicing on a bunch of the old mother boards and am comfortable enough to socket my own tivo.

I tried sending an email to the person who I paid $14 for in the link I posted above, but it returned as being a dead email address.

[Neosum]

you want a surface mount PLCC32 socket, and your sst39 chip should also be plcc32

Anyone have the mouser part number for this? Also what's the pitch listed at mouser? 1.27 mm and 2.54 mm.

I think I'm gonna buy a programmer and chips/sockets to flash my own prom then possibly sell any extras I end up with.

[ScanMan]

Anyone have the mouser part number for this? Also what's the pitch listed at mouser? 1.27 mm and 2.54 mm.

I think I'm gonna buy a programmer and chips/sockets to flash my own prom then possibly sell any extras I end up with.Mouser part numbers:

575-943217 -> PLCC Surface Mount Standard Sockets 32 POS. TIN PLATED SMT
804-39VF0107INHE -> SST39VF010-70-4I-NHE (backordered)
804-37VF0107CNHE -> SST37VF010-70-3C-NHE (available)

Careful with the SST37's, they require 12V to erase which can be problematic with some programmers. I've had no trouble flashing new SST37 chips but so-so erasing with my cheap-a$$ programmer. No problems whatsoever with the 39's (only require 3.3V to erase) which is why most prefer them.

[Jamie]

Anyone have the mouser part number for this? Also what's the pitch listed at mouser? 1.27 mm and 2.54 mm.

I think I'm gonna buy a programmer and chips/sockets to flash my own prom then possibly sell any extras I end up with.I have flashed with a $15 SIL680 based ide pci card that has a PLCC32 prom, which works fine on the SST39 chips. Something like this: link (http://www.newegg.com/Product/Product.aspx?Item=N82E16815124001). You have to socket the PROM on the card, but that's good practice before you start working on your tivo :) The BIOS upgrade application can be found on the silicon image site (link (http://www.siliconimage.com/support/supportsearchresults.aspx?pid=31&cid=15&ctid=2&osid=0&)).

There are probably other cards with flashable PLCC32 proms you can find too, if you look around. Certainly you could use an SATA card instead of IDE, if you preferred that.

[tivo4mevo]

Mouser part 804-39VF0107CNHE -> SST39VF010-70-3C-NHE is also available now and is the commercial version of the SST39 (3.3v programming voltage but with a slightly narrower operating temperature range).

The Intel 100B NICs, like this (http://cgi.ebay.com/HP-Intel-10-100B-TX-PCI-LAN-Card-New-D5013-63001_W0QQitemZ320222726237QQihZ011QQcategoryZ51191QQrdZ1QQssPageNameZWD1VQQ_trksidZp1638.m118.l1247 QQcmdZViewItem), are another cheap option for programming. It already has a socket, and one can use Intel's fboot.exe (attached) DOS-based flash application. I have no experience with that eBay seller, mind you, just a visual. You can also often find these cards at local used computer part shops for a few bucks.

[Neosum]

Mouser part 804-39VF0107CNHE -> SST39VF010-70-3C-NHE is also available now and is the commercial version of the SST39 (3.3v programming voltage but with a slightly narrower operating temperature range).

The Intel 100B NICs, like this (http://cgi.ebay.com/HP-Intel-10-100B-TX-PCI-LAN-Card-New-D5013-63001_W0QQitemZ320222726237QQihZ011QQcategoryZ51191QQrdZ1QQssPageNameZWD1VQQ_trksidZp1638.m118.l1247 QQcmdZViewItem), are another cheap option for programming. It already has a socket, and one can use Intel's fboot.exe (attached) DOS-based flash application. I have no experience with that eBay seller, mind you, just a visual. You can also often find these cards at local used computer part shops for a few bucks.

I'm surprised my local dealer has this exact nic in stock. Were you able to extract the image from your prom with this or is it write only?

[tivo4mevo]

It's possible to both read and write using fboot.exe. digdug describes the process in his post (earlier in this thread).

[bcc]

I've flashed tivo eproms with the intel e100 under linux as well. I detailed how to do this a few years back I believe. Note that older e100s have the eprom in a socket already, newer e100s have the eprom soldered in.

Also once you've socketed a tivo, you can use the tivo to burn additional flash chips as well.

[Neosum]

I damaged my original prom during removal and can't read the image from it at all. I managed to get my TCD649080 socketed and is good to go though (fan still spins).

The intel 100B nic that I bought came with a prom in the socket already. Would that prom work on tivo if I flash it with the dual tuner prom? If not, I'll have to wait for my shipment from mouser.

Anyone have the prom image for my model? Original or hacked will do. I see the 2.5 prom image but I'm not sure if it'd work on the TCD649 model.

Thanks.

[mrpenguin]

what model number is the prom? it should have it etched in the chip. I'd bet it might work. your tivo is socketed, why not try. You can always rewrite the orig fw back on the card's chip.

[Neosum]

It turns out the card didn't have a prom in the socket. But I found a prom in one of my old asus motherboards, secure in a socket. It's the exact same size/shape chip as the sst37s.

On the chip the label says "K8AA2 1002 8028 GMZ1"

Edit: Looks like the chip from my old asus mobo was fried... which explains why the board crapped out on me. It was a very nice board too, but I already practiced on it and removed a bunch of chips before noticing this socket with the prom in it :(

Thanks everyone for your help. I should be all setup once I get the new prom from mouser.

[Neosum]

I don't have any available proms to test with (still waiting for my shipment from mouser). Is there anyway to test whether my socket is soldered properly and have no bridges or cold solder joints? When I plug the power in (without any prom), the fan spins and the front red led lights up.

[jt1134]

If it boots with the original prom you should be fine.

[Neosum]

I just wanted to followup and let everyone know that my tivo works wonderfully. Thanks for all of your help.

[Omikron]

I just wanted to followup and let everyone know that my tivo works wonderfully. Thanks for all of your help.

What ended up being the problem?

[Neosum]

I just didn't have a good prom to work with since my original was damaged during removal.

I have 4 extra proms with sockets if anyone wants to take them off my hands for small convenience fee. I can flash them too, but I only have the flash image for the TCD649.

PM me if anyone wants them.

[Hacker007]

This thread has a lot of good information. My 2c worth is covered by the following youtube video. The technique might look a little cheesy but it worked great for me.

http://www.youtube.com/v/e5qYG95bbz8&hl=en

[macwizard8112]

Ok, from the rumor mill Kraven has stopped doing them? If so, I'm game to pick up where he left off. Have SMD reworkstaion and not affraid to use it. :)

If Kraven is still doing them, I have *NO* intentions of stepping on his feet!!

I currently only have the SA-2's firmware. So for the Direct Tivo people, and the HD Tivo people I need at least links to the 'enhanced' firmwares.

I have 3 R10's that need PROM

[digdug]

LOL, I just found some pictures I took while PROMing my TIVOS several months ago. It's good for a laugh. Yeah, I was really paranoid of frying the components.

TIPS:
a) Heat gun worked great for me. Plus you can tell the wife it's for arts & craft.
b) Practice on some unused/junk equipment. Don't let your kid catch you taking his toys.
c) You should be able to solder the new PROM with the residual solder on the board. Waste not, want not.

-doug