PDA

View Full Version : PROM socketing



Pages : [1] 2

KRavEN
03-30-2003, 08:49 AM
I know this is pretty self serving, but I keep seeing posts by people wanting to get this done and contemplating doing it themselves and this is something that should really not be attempted by someone that doesn't know what they are doing. It is very possible to render your TiVo totally worthless if you screw it up.

Unless you really know what you are doing with an iron, don't attempt it!

To remove the prom requires a special tip that can heat all pins on the prom at once so that it can be removed. Hot air can also be used to remove it. Last case is trying to use solder wick, but that would be very difficult to ensure all the solder is removed well enough that you don't damage the pads on the board when remove it.

Next the socket. Sockets in general are pretty hard, but PLCC (TiVO prom formfactor) sockets are much easier compared to TSOP sockets (xbox bios formfactor). There is still pretty much a requirement for a stereoscope or some other sort of magnification as the soldering is done on tiny points inside the socket itself and you have to be carefull not to bridge the legs or melt the pastic of the socket that is very close to the legs.

Flashing the prom also requires special equipment like a DATA I/O device that has PLCC sockets and is designed to flash chips. It may also be possible to flash the bios in motherboards that have a socketed PLCC bios chips in them. I have an ABIT BX2 that has this bios and socket, but I've not tried to flash non pc bios chips with it. I'm sure it's possible with the right software, I've just not looked for it.

If anyone is wanting to get this done, I have the facilities and the experience replacing and socketing the S2 TiVo proms. I can do both SA and DTiVo versions. Send me a PM if you are wanting to get it done, just don't screw up your TiVO cuz you don't know what you're doing.

---

UPDATE by alldeadhomiez, 7/24/2004:

KRavEN is no longer offering this service (http://www.dealdatabase.com/forum/showpost.php?p=157268&postcount=55).

Sleeper (http://www.dealdatabase.com/forum/showpost.php?p=165153&postcount=46) and MudShark (http://www.dealdatabase.com/forum/showpost.php?p=175270&postcount=67) will socket and reflash your PROM for $50 plus shipping. Or, keep reading this thread to learn how to do it on your own.

At the time of this writing, the only model which needs a compromised PROM in order to boot a hacked drive is the HR10-250 (HD TiVo). It is suspected but not confirmed that the upcoming "silver" Series2 standalones may also require this modification.

UPDATE by JJBliss, 12/21/2004:

Sleeper is no longer a member of this Forum. Mudshark is, and has visited the forums recently. I am unaware if Mudshark is still doing PROM mods.

The HR10-250 no longer requires a modified PROM in order to boot modified software. killhdinitrd supports this unit as well as other non Series 2.5 units. Series 2.5 (nightlight and R10) units still require PROM socketing or modifications as of this writing.

cali
03-30-2003, 11:38 AM
Kraven:

Is the PROM code publicly available?
Is the ONLY purpose of the prom code to allow Bash?
I have a series and have so far been able to d 120GB and Bash.


Thanks
Cali

mrblack51
03-30-2003, 01:16 PM
Originally posted by cali
Kraven:

Is the PROM code publicly available?
Is the ONLY purpose of the prom code to allow Bash?
I have a series and have so far been able to d 120GB and Bash.

There are only two changes needed to the prom code. If you grab the code off of your drive, the needed changes via a hex editor are simple enough.

The purpose of the modified prom is to allow booting of unsigned kernels. Bash is a visible effect of that. Basically, the kernel has signatures for everything in the root partition thats worth messing with, and deletes anything without a good signature. this prom hack lets you modify the kernel, thus allowing you to compromise that check. once that is done, you can do whatever you want.

MuscleNerd
03-30-2003, 08:41 PM
The patches I came up with are posted over on AVS in this post (http://www.tivocommunity.com/tivo-vb/showthread.php?postid=784253#post784253) . But yeah like Kraven said, knowing them and applying them are very different :)

By the way...I think at the time I was going for smallest patch possible. But with that version, it still computes the kernel and bootrom SHA hashes. Even though the comparison of final hash values is ignored, it still slows down the boot cycle. But I guess nobody has noticed :)

mrblack51
03-30-2003, 09:15 PM
Originally posted by MuscleNerd
The patches I came up with are posted over on AVS in this post (http://www.tivocommunity.com/tivo-vb/showthread.php?postid=784253#post784253) . But yeah like Kraven said, knowing them and applying them are very different :)

By the way...I think at the time I was going for smallest patch possible. But with that version, it still computes the kernel and bootrom SHA hashes. Even though the comparison of final hash values is ignored, it still slows down the boot cycle. But I guess nobody has noticed :)

so this patch doesnt have the 'speed increases' that the s1 dtivo prom upgrade offered. ah well, while that would be nice, these have the needed effect.

thanks for your work btw

cali
03-30-2003, 10:30 PM
Thanks for the replies guys. I have lots of prom chips at work and a nice data i/o less than 10ft away.
Ill get around to it one day....


cali

geowar
04-11-2003, 12:01 PM
cali> Is the ONLY purpose of the prom code to allow Bash? I have a series and have so far been able to d 120GB and Bash.

How are you BASHing wo/PROM hack? I dd an old 3.0.2 kernel and BASH_ENV it to get in. My TiVo has the '39 part; I'm investigating getting it to flash in place.

cali
04-11-2003, 07:37 PM
Im using the one version that allows you to do the hack...2.015 or something like that...

Look for mrblacks post on his hacking experience; everythign you need is in there.

Took me about a good hour to do it the first time.

geowar
04-11-2003, 09:49 PM
>Im using the one version that allows you to do the hack...2.015 or something like that...

I'm using 3.0.2 which has USB network device support and also allows the BASH_ENV hack. v3.2 prevents the BASH_ENV hack.

I'll go read MrBlack's posts to see if there's something I missed. Thx. ;-)

lazerexp
04-15-2003, 02:04 AM
Wouldn't another reason to do the PROM hack be that you can run any version of the software?


Kraven you still doing the mod?

KRavEN
04-15-2003, 10:34 AM
Yeah I am. Primary reason for the new prom is to get in without the bash_env backdoor plus it's currently the only known way in with 3.2 software.

It's also very usefull if you want to compile and run your own kernel.

KRavEN
11-29-2003, 10:08 PM
I now have the service in my webstore. Go here:


Prom Socketing Service under Hardware -> new in box -> accessories (http://www.dealsbyjerry.com)

MuscleNerd
12-01-2003, 06:35 PM
Originally posted by KRavEN
Yplus it's currently the only known way in with 3.2 software.
That post was before monte was publicly released (still, having a modded prom simplifies the boot process).

SurfBoy
12-02-2003, 08:19 PM
what does PROM socketing do for the S2?

MuscleNerd
12-02-2003, 08:22 PM
There are several links in the "chain" that keeps the S2 secure. By using a modded PROM, the very first link in that chain is broken, bypassing all the other links (BASH_ENV, the need for monte, etc).

SurfBoy
12-02-2003, 09:05 PM
so if i had a modded PROM on my HDVR2, what's the best software configuration for extracting, burning, and tivoweb?

KRavEN
12-04-2003, 02:19 PM
You can just follow Stan's how-to on setting up with a prom mod. Basically, you do it just like the series 1. Kill the initrd, add the files you want, stir and enjoy.

tivosa
01-02-2004, 11:23 PM
You can just follow Stan's how-to on setting up with a prom mod. Basically, you do it just like the series 1. Kill the initrd, add the files you want, stir and enjoy.

does the prom hack "PROM Protection v1.0 by Taran" work for dvr40?
is there anything else i need to know? ie: what is flashing the chip?
so will i be able to get the bash prompt from an ethernet connection?
im using mac osx hoping that the terminal app will work. i am able to mount the drive using ext2fs (after rebooting the mac) from an external firewire case.

MudShark
01-03-2004, 01:11 PM
I'm not sure about the dvr's. But imagine it should work. I didn't use Taran's thingy. I just modded the bin file and reprogramed. (just make a back-up of the HD and the PROM *FIRST*. I know it sounds obvious, but many people don't and burn)

Do as Kraven says. killintrid is a must, and then add your software and hacks (rcsysinit.author, etc)


does the prom hack "PROM Protection v1.0 by Taran" work for dvr40?
is there anything else i need to know? ie: what is flashing the chip?
so will i be able to get the bash prompt from an ethernet connection?
im using mac osx hoping that the terminal app will work. i am able to mount the drive using ext2fs (after rebooting the mac) from an external firewire case.

alldeadhomiez
01-03-2004, 02:11 PM
There is no known need to lock down the S2 flash as the SST37 chip is not believed to be in-circuit programmable.

I think the Trinity/"RID" boards, DVR40 included, all use a different version of the firmware from what we see on the older models. I have confirmed this to be the case on a DSR704; here is the ID information I found:


0000000: 0bf0 0109 0000 0000 0001 23c0 84a1 0e60 ..........#....`
0000010: 3fff a383 267b 617b 893d 4a79 bb21 6594 ?...&{a{.=Jy.!e.
0000020: 0000 0000 0000 0000 0000 0000 0000 0000 ................
0000030: 0000 0000 0000 0000 0000 0000 0000 0000 ................
0000040: 5469 566f 2f6d 6970 732f 6272 636d 2f72 TiVo/mips/brcm/r
0000050: 656c 0032 2e35 0000 0000 0000 0000 0000 el.2.5..........

Sleeper
01-03-2004, 06:58 PM
There is no known need to lock down the S2 flash as the SST37 chip is not believed to be in-circuit programmable.

I can affirm this!


I think the Trinity/"RID" boards, DVR40 included, all use a different version of the firmware from what we see on the older models. I have confirmed this to be the case on a DSR704; here is the ID information I found:

I'm curious if the "old" firmware will boot a newer DVR40. I wonder if the new firmware has some RID initialization stuff in it. Unfortunately, I don't have a DVR40 to play with.

alldeadhomiez
01-03-2004, 07:53 PM
I'm curious if the "old" firmware will boot a newer DVR40. I wonder if the new firmware has some RID initialization stuff in it. Unfortunately, I don't have a DVR40 to play with.

Firmware 1.18 will not boot a DSR704 properly. It seems that they rearranged the code a bit but oddly enough they did not bother to add checks to keep the compromised 3.1u5 kernel from booting.

SurfBoy
01-06-2004, 01:48 PM
So does this mean that the PROM mod is not yet figured out for SD-DVR40 or it cannot be done?

noneed
01-16-2004, 02:59 PM
Does anyone know where to get the tools if I want to do the mod by myself? It seems I can not find sst39vf010 chip for sale anywhere, its only listed on SST web site without offer to buy it, have to call them? Also after the mod, is it possible to use homieflash rather than using special IO programers? Id hate to pull it out each time Id want to make change.

Sleeper
01-16-2004, 03:20 PM
Also after the mod, is it possible to use homieflash rather than using special IO programers? Id hate to pull it out each time Id want to make change.

No, you don't have to pull it each time assuming that the change you made will still boot the tivo.

MuscleNerd
01-16-2004, 03:46 PM
Also after the mod, is it possible to use homieflash rather than using special IO programers? Id hate to pull it out each time Id want to make change.
Do you mean: each time you make a change to the eeprom image? In any case, homieflash will work. Personally, I ran a version of homieflash that gave the process highest priority, to prevent possible complications. But otherwise it's the same.

MuscleNerd
01-16-2004, 03:47 PM
So does this mean that the PROM mod is not yet figured out for SD-DVR40 or it cannot be done?
If somebody were to post (or make available) the complete SD-DVR40 eeprom image, I'm sure the proper patch could be found.

apn64
01-16-2004, 04:39 PM
It seems I can not find sst39vf010 chip for sale anywhere, its only listed on SST web site without offer to buy it, have to call them.

I understand that AMD's AM29LV010B is a direct replacement, so you mind find that easier to source.

MudShark
01-16-2004, 08:33 PM
I was told, but haven't verrified, that the AMD chips aren't exactly the same. I guess read the data sheets and see.


I understand that AMD's AM29LV010B is a direct replacement, so you mind find that easier to source.

dubbya
01-16-2004, 11:08 PM
I was told, but haven't verrified, that the AMD chips aren't exactly the same. I guess read the data sheets and see.

They're different but supported.

My good friend expat started a thread about the Trinity boards over at pvrhax0r:

http://www.pvrhax0r.com/forum/showthread.php?threadid=4

The patches for the 2.5 flash are included in his post.

sdguy
01-17-2004, 06:24 PM
[QUOTE=MuscleNerd]The patches I came up with are posted over on AVS in this post (http://www.tivocommunity.com/tivo-vb/showthread.php?postid=784253#post784253) . But yeah like Kraven said, knowing them and applying them are very different :)

Anyone care to repost the patches or send them to me? The thread at tivocommunity seems to have been deleted.

Thanks

mrblack51
01-17-2004, 08:12 PM
[QUOTE=MuscleNerd]The patches I came up with are posted over on AVS in this post (http://www.tivocommunity.com/tivo-vb/showthread.php?postid=784253#post784253) . But yeah like Kraven said, knowing them and applying them are very different :)

Anyone care to repost the patches or send them to me? The thread at tivocommunity seems to have been deleted.

Thanks

patches for the 1.18 prom (not the 2.5 prom used on RID units): http://www.dealdatabase.com/forum/showthread.php?t=27474

noneed
01-21-2004, 01:19 AM
Ive got SA S2 box which has 1.6 prom, is there patch for this one? Also any way to dump it? The getprom does not recognize -dump switch and /prom folder is empty.

AlphaWolf
01-21-2004, 02:54 AM
I am not sure about this, but I think there might be an easy, cheap, and clean answer to prom socketing. Wolfson pointed me to something called chipquik (http://www.chipquikinc.com/), which claims to easily remove QFPs, PLCC's, and SOIC's.

Now, I don't know exactly how this stuff is supposed to work, but I did some research and found that the chipquik includes an alloy whose key element is bismuth. Of all metals, bismuth is the one with the second lowest melting point (mercury of course being the lowest.)

Bismuth melts at around ~140F afaik, and while I am just guessing here, I think the idea behind chipquik is that you melt the bismuth solder in with the regular lead solder (which melts at ~360F afaik) on all of the contact points, hence reducing their melting points. Once this is done, you can probably do like the website says and use hot air to easily pop the prom off of the motherboard....I think a hair dryer could even be used for this, because the melting point could easily go below 200F, depending on the material used to hold the prom to the motherboard. From there you can easily wick away the bismuth solder, then just add the socket to the board.

Any soldering pros care to comment on this? My S2 "RID enabled" receiver should arrive soon, and theres a local store here called circuit specialists (somewhere near southern and country club for you phoenix residents) that carries this chipquik kit for $18...I might have a look at trying this.

PlainBill
01-21-2004, 12:26 PM
AlphaWolf, Chipquik works well. With luck, the solder / chipquik mix will retain heat long enough that you can simply lift the prom from the board. Cleaning up the residue does require care - it is possible to lift the pads if you aren't careful.

This still leaves the problem of soldering a replacement socket in place. Frankly, I've done a lot of soldering, including pulling surface mount ICs. When I looked at the HDVR2, I decided if I ever wanted to do it, I would send the board to Kraven and have him do it.

PlainBill

Sleeper
01-21-2004, 12:36 PM
This still leaves the problem of soldering a replacement socket in place. Frankly, I've done a lot of soldering, including pulling surface mount ICs. When I looked at the HDVR2, I decided if I ever wanted to do it, I would send the board to Kraven and have him do it.

When I did socketed the prom, I took a small exacto knife and cut the plastic grid out of the bottom of the socket so when you look at the bottom of the socket (or thriough the socket from the top) all you see are the pins. It makes it a lot easier to solder (with an iron) without the plastic grid.

KRavEN
01-24-2004, 02:24 PM
When I did socketed the prom, I took a small exacto knife and cut the plastic grid out of the bottom of the socket so when you look at the bottom of the socket (or thriough the socket from the top) all you see are the pins. It makes it a lot easier to solder (with an iron) without the plastic grid.

Yeah, but once you cut the grid you should probably not plan on removing and inserting multiple times since the grid is what holds it together. Socket will probably break pretty easily.

Another option is to just solder in an in-circuit programmable chip like that AMD chip and skip the socket all together.

Sleeper
01-24-2004, 03:36 PM
Yeah, but once you cut the grid you should probably not plan on removing and inserting multiple times since the grid is what holds it together. Socket will probably break pretty easily.

Initially, I thought it was going to weaken the socket, but the socket seems just as durable without the bottom. I performed many insertions/removals without a hitch.

MudShark
01-24-2004, 06:30 PM
I dunno about that. If you look at how a PLCC extraction tool works, it really just uses the two opposite corners. It pulls the chip against the socket. It doesn't try to pull the socket off the board. In actuality its pushing the socket into the board. If you really feel scared, you could add a little epoxy to hold down the socket. Not to mention the life cycle of the socket isn't meant for hundreds of insertion/extraction cycles. I remember the ISA bus slots are rated for 10 insert/extract cycles.



Yeah, but once you cut the grid you should probably not plan on removing and inserting multiple times since the grid is what holds it together. Socket will probably break pretty easily.

Another option is to just solder in an in-circuit programmable chip like that AMD chip and skip the socket all together.

jeboo
01-28-2004, 04:17 PM
I was told, but haven't verrified, that the AMD chips aren't exactly the same. I guess read the data sheets and see.

Just a heads up, Mouser electronics has the ssts in stock (be fast, only about 20 left)...You can buy them individually for about 2$ each...Have fun!

jeboo

MudShark
01-29-2004, 07:17 AM
I'm not sure why I would buy them. If one has a programer, then they can copy the bin file and revert to the original program if needed. I just reprogramed mine and mashed it into the newly added socket.



Just a heads up, Mouser electronics has the ssts in stock (be fast, only about 20 left)...You can buy them individually for about 2$ each...Have fun!

jeboo

rpl
01-31-2004, 05:06 PM
My good friend expat started a thread about the Trinity boards over at pvrhax0r:

http://www.pvrhax0r.com/forum/showthread.php?threadid=4

The patches for the 2.5 flash are included in his post.


We have located four interesting patches to the new 2.5 PROM:

24b0 = 10400014 -> 00000000 (enable debug msgs)
2cdc = 14830004 -> 14840004 (disable prom sha-160)
3a1c = 1043000c -> 1042000c (disable kernel check)
35f8 = 0c771940 00000000 0440ff97 -> 0c7718d7 00000000 24020000 (skip memchk)
Just had my PROM socketed by Kraven. Great work btw. Clean work,fast turnaround. Here is what I'm seeing on my serial output after killing the initrd.

PCI(13,0) DevVen= 351033 ClasRev= c0310 USB
PCI(13,1) DevVen= 351033 ClasRev= c0310 USB
PCI(13,2) DevVen= e01033 ClasRev= c0320 Unknown Device
PCI(14,0) DevVen= 1741 ClasRev= ff0000 TiVo ASIC
reset -
color_bars -
msw - [ -32 | -16 | -8 ] <address> <value>
msr - [ -32 | -16 | -8 ] <address>
help -
param - [ <new boot args> ]
netboot - [ -skip ] [ -f <file> ] [ <boot string> ]
boot - [ -skip ] [ -3 | -6 ] [ <boot string> ]
ememtest -
identify -
Hit two returns to stop autoboot
Attempting to disk load partition 6
Kernel signed by 'Kernel release key'
Hashing kernel... done
Hash mismatch
Hash mismatchLooks like the enabled messages worked ok. Not sure what the PROM SHA-160 check would look like, but no joy with the Hash mismatch. Anyone else have any sucess with editing 3a1c to 1042000c to kill the kernel check?

alldeadhomiez
02-01-2004, 01:09 AM
Looks like the enabled messages worked ok. Not sure what the PROM SHA-160 check would look like, but no joy with the Hash mismatch. Anyone else have any sucess with editing 3a1c to 1042000c to kill the kernel check?

The hash mismatch messages are normal. Try a known good kernel and make sure console output is enabled.

rpl
02-01-2004, 02:30 PM
You were correct ADH it was an operator error. With a unmodified kernel I had
Hit two returns to stop autoboot
Attempting to disk load partition 6
Kernel signed by 'Kernel release key'
Hashing kernel... done
Checking signature... done.
Signed, valid for release and with a properly killed initrd
Hit two returns to stop autoboot
Attempting to disk load partition 6
Kernel signed by 'Kernel release key'
Hashing kernel... done
Hash mismatch
Hash mismatch
Loading R5432 MMU routines.
..
booted just fineI was trying to use the killinitrd-s2-v3.x that I had with the monte files.

yonk
02-10-2004, 09:47 PM
This chip works in my DSR7000:

NEWARK INONE PART #: 08C4182 ; ICs Flash Memory, CMOS, Parallel Interface, 1MB, 70 nS, 3 V Supply Voltage, 32-PLCC
QUANTITY: 2 @ $2.68 = $5.36

I think it's the AMD, but don't remember! I used the Chipquick method for removal and it worked like a charm. I also cut away the center web of the PLCC socket. Even with a very fine tip iron it was too hard to get to all the pins.

BTW - I was trying to netboot a kernel, it would read the file off my tftp/bootp server just fine, but since the kernel was DD'd off the disk the size is too large and the netboot pukes. Does someone have a utility to determine the exact # of blocks to make the kernel image so netboot works?

cheers - Yonk

Sleeper
02-11-2004, 01:15 AM
I also cut away the center web of the PLCC socket. Even with a very fine tip iron it was too hard to get to all the pins.

That is definately the trick!



BTW - I was trying to netboot a kernel, it would read the file off my tftp/bootp server just fine, but since the kernel was DD'd off the disk the size is too large and the netboot pukes. Does someone have a utility to determine the exact # of blocks to make the kernel image so netboot works?


Please let me know if you are successful with the netboot. I have not attempted it but it is something that I always wanted to try - just haven't gotten to it.

tytyty
02-11-2004, 01:29 AM
This chip works in my DSR7000:

NEWARK INONE PART #: 08C4182 ; ICs Flash Memory, CMOS, Parallel Interface, 1MB, 70 nS, 3 V Supply Voltage, 32-PLCC
QUANTITY: 2 @ $2.68 = $5.36

I think it's the AMD, but don't remember! I used the Chipquick method for removal and it worked like a charm. I also cut away the center web of the PLCC socket. Even with a very fine tip iron it was too hard to get to all the pins.

BTW - I was trying to netboot a kernel, it would read the file off my tftp/bootp server just fine, but since the kernel was DD'd off the disk the size is too large and the netboot pukes. Does someone have a utility to determine the exact # of blocks to make the kernel image so netboot works?

cheers - Yonk


These are in-circuit flashable from what Im reading on the data sheet nice find. :p

AlphaWolf
03-07-2004, 12:48 PM
NEWARK INONE PART #: 08C4182 ; ICs Flash Memory, CMOS, Parallel Interface, 1MB, 70 nS, 3 V Supply Voltage, 32-PLCC
QUANTITY: 2 @ $2.68 = $5.36

I think it's the AMD, but don't remember! I used the Chipquick method for removal and it worked like a charm. I also cut away the center web of the PLCC socket. Even with a very fine tip iron it was too hard to get to all the pins.


/me doesn't know how he missed this earlier.

Very interesting. I have been too much of a coward to try this (also lacking free time,) would you mind describing the process you went through with this whole thing? The main thing that scares me, is somebody said that its possible to lift the pads with the chipquik, but since it doesn't get very hot, I am not certain of what the odds of this happening are.

If it sounds easy enough, I might get around to doing this during spring break, and maybe publish a howto (w/pictures) for it. FWIW, the hardest soldering jobs I have ever done were for modding a PS2 (27 solder points) and an xbox (13 solder points) but neither of which involved removing any surface mount chips. (PLCC look easier than your average surface mount though)

jeboo
03-07-2004, 02:05 PM
/me doesn't know how he missed this earlier.

Very interesting. I have been too much of a coward to try this (also lacking free time,) would you mind describing the process you went through with this whole thing? The main thing that scares me, is somebody said that its possible to lift the pads with the chipquik, but since it doesn't get very hot, I am not certain of what the odds of this happening are.

If it sounds easy enough, I might get around to doing this during spring break, and maybe publish a howto (w/pictures) for it. FWIW, the hardest soldering jobs I have ever done were for modding a PS2 (27 solder points) and an xbox (13 solder points) but neither of which involved removing any surface mount chips. (PLCC look easier than your average surface mount though)

I posted previously that Mouser electronics has plenty of SSTs in stock...Still do btw. This was my first SMT experience as well, and heres a quick breakdown, including costs (If you are only going to do 1-2 units, this will not be worth it! Send it to Kraven).

Supplies:
1) I used the butane soldering iron from RatShack (15$). Sad, I know.

2) Chips and sockets ordered from Mouser/Digikey (2$ for a chip and socket).

3) Willem EEPROM programmer from ebay (including shipping and the plcc32 adapter, 50-70$). I bought this cause I was concerned the lack of real SMT equipment may fry the original chip during removal...And I didnt really care to try the hot-swap deadhomiez mentioned. This programmer really is worth the $, especially if you mess with other h/w :) Also, the SST39vf chips will program/erase fine at 5V (dont need the plcc32 adapter that has a 3.3V jumper).


Once you have everything, I would practice removing SMT chips and installing sockets on any old PC cards you have...Once you find the butane settings and method that works, its easy...My extraction went smoothly, but I've heard from others if a pad is lifted, you're in for some work. The socket was soldered in with a regular iron after punching out the bottom piece. Flash with programmer or deadhomiez prog.

It really is a nice improvement...It increases boot time a bit, which is nice for dev'ing and testing :)

jeboo

AlphaWolf
03-07-2004, 04:22 PM
I posted previously that Mouser electronics has plenty of SSTs in stock...Still do btw. This was my first SMT experience as well, and heres a quick breakdown, including costs (If you are only going to do 1-2 units, this will not be worth it! Send it to Kraven).

Supplies:
1) I used the butane soldering iron from RatShack (15$). Sad, I know.

2) Chips and sockets ordered from Mouser/Digikey (2$ for a chip and socket).

3) Willem EEPROM programmer from ebay (including shipping and the plcc32 adapter, 50-70$). I bought this cause I was concerned the lack of real SMT equipment may fry the original chip during removal...And I didnt really care to try the hot-swap deadhomiez mentioned. This programmer really is worth the $, especially if you mess with other h/w :) Also, the SST39vf chips will program/erase fine at 5V (dont need the plcc32 adapter that has a 3.3V jumper).


Once you have everything, I would practice removing SMT chips and installing sockets on any old PC cards you have...Once you find the butane settings and method that works, its easy...My extraction went smoothly, but I've heard from others if a pad is lifted, you're in for some work. The socket was soldered in with a regular iron after punching out the bottom piece. Flash with programmer or deadhomiez prog.

It really is a nice improvement...It increases boot time a bit, which is nice for dev'ing and testing :)

jeboo

I am more interested in doing it myself than I am with saving money though.

The butane soldering iron you got, does that use hot air? or is it just a normal tip, only heated with butane gas?

BTW, I still want to try the chipquik method just for novelty sake though (it just sounds interesting)

Also, why did you buy a programmer if you installed the socket? Isn't it much easier just to have the tivo itself program it anyways?

jeboo
03-07-2004, 09:10 PM
I am more interested in doing it myself than I am with saving money though.

The butane soldering iron you got, does that use hot air? or is it just a normal tip, only heated with butane gas?

BTW, I still want to try the chipquik method just for novelty sake though (it just sounds interesting)

Also, why did you buy a programmer if you installed the socket? Isn't it much easier just to have the tivo itself program it anyways?

The soldering iron comes with two tips, one for "hot air" and one for normal soldering. The chipquik method sounds neat indeed, but with the hot air tip, you will have everything you need.

Call it paranoia, but I was worried the original PROM wouldnt survive the extraction. If that happens, you cannot boot to flash the new chip...So the programmer was basically an anti-brick purchase.

Nothing like doing it yourself :)

MudShark
03-07-2004, 09:14 PM
I did it with a SMD rework station. Only thing with reusing the chip, if adding a socket, is cleaning off all the solder from the 'pins' I had a tivo go belly up after a few months. Really didn't do much more then pull the chip out of the socket adn inspect the pins. looked good, put it back in and it is working again.


The soldering iron comes with two tips, one for "hot air" and one for normal soldering. The chipquik method sounds neat indeed, but with the hot air tip, you will have everything you need.

Call it paranoia, but I was worried the original PROM wouldnt survive the extraction. If that happens, you cannot boot to flash the new chip...So the programmer was basically an anti-brick purchase.

Nothing like doing it yourself :)

roberton
03-08-2004, 09:54 PM
Help, i think that i burn the original sst37 while i was desoldering it using solder wick (need more practice), my tivo is a SD-DVR40, does any one have a virgin image of the prom, i think is firmware v2.5, am i rigth?

thanks for your help

Sleeper
03-13-2004, 02:28 AM
I take a piece of aluminum foil and cut a square hole in it to make a heat shield. Then blast the prom with a heat gun while applying some prying pressure with a pick. Sucker pops right off every time without damaging pads.

Cut the bottom out of the prom socket and solder in place with a fine tip iron. A magnifier helps.

KRavEN
03-29-2004, 01:15 PM
BTW, I'm not doing the sockets anymore. I just don't have enough time with my ever increasing job responsibilities.

AlphaWolf
03-29-2004, 04:25 PM
I take a piece of aluminum foil and cut a square hole in it to make a heat shield. Then blast the prom with a heat gun while applying some prying pressure with a pick. Sucker pops right off every time without damaging pads.

Cut the bottom out of the prom socket and solder in place with a fine tip iron. A magnifier helps.

Sounds nice, can you be a bit more descriptive though? :D

Sleeper
03-29-2004, 05:07 PM
Sounds nice, can you be a bit more descriptive though? :D

Not really, but here is a picture of the heat shield.

jeboo
03-29-2004, 05:10 PM
Sounds nice, can you be a bit more descriptive though? :D

I did the same thing as Sleeper...Literally cut a hole in a piece of alum. foil just large enough for the chip...Take either a pick or the smallest flathead screwdriver you have (kinda like the eyeglass kit ones) and insert under one of the corners...I chose to heat three sides of the chip and pry it up, leaving one row still attached...Then the last row is painless. BE conservative, its better to have to stop and start over than to lift pads.

Have fun :)

Sleeper
03-29-2004, 05:15 PM
I chose to heat three sides of the chip and pry it up, leaving one row still attached...Then the last row is painless. BE conservative, its better to have to stop and start over than to lift pads.

I heat the whole chip EVENLY. You will feel/see it start to give. I don't necessairly agree with the stop and start over. Tourch the puppy until it pops right off. You will not damage the pads unless you really pry the chip real hard. Gentle pressure is all you need.

AlphaWolf
03-29-2004, 05:35 PM
What kind of "heat gun" do you use? And how exactly did you apply the heat to the pins?

MrPinks
04-05-2004, 07:37 PM
ChipQuik is so easy to use, I don't even bother with hot air on SMDs. The melting point is so low it makes removal of devices a breeze. All you have to do is get it on all the pins (make sure you use the flux) and then just keep going around the device with your iron a few times. The ChipQuik material retains heat for quite a while, so you can work it easily. After you've gone around the device a few times, you can literally just lift it off the board with almost no force, using either a small screwdriver or other implement (I use a precision awl that works well for this).

After you lift the device, remove as much of the ChipQuik as you can with a Q-Tip. The way to do this is to run the iron over the pads, then push all the material in one direction. The ChipQuik will "smoosh" right off of the pads under the pressure of the Q-Tip. Clean up any remainder with solder wick, and then remove all the crud from the flux with isopropyl alcohol and some more Q-Tips.

Use more flux on the pads (you can use the ChipQuik flux, if you want) and then solder on your socket. The additional flux will help immensely in soldering on the new part and helping to prevent solder bridges.

I don't like the idea of removing the bottom of the PLCC socket as some have suggested, mainly because it makes it easy to push the socketed part too far down into the socket. This makes for possible contact trouble and/or removal difficulty. It's not that hard to solder the socket correctly, and even if you melt a bit of the plastic, it's not going to hurt anything (just make sure there's no solder embedded in it).

I've done a zillion SMDs and sockets just this way, and it works very well.

-Pink

(I'll help you with your soldering technique if y'all will help me with my stupid hack questions!)

redfiver
06-21-2004, 08:28 PM
Since Kraven no longer has time to do the prom socket mod, is anyone else offering this service for a HD-Tivo?

I'm inclined to try this hardware mod on my own (It's only a $1000 unit, right? :) ), but I'm sure there are others out here too nervous to try modding their unit themselves.

MudShark
06-21-2004, 09:00 PM
I've done both of mine, no probs so far. Been running for close to a year now. I did use a SMD reworkstation. Took about an hour, from start to watching shows. I think its a cleaner/easier method then the monte. but them I'm more a hardware guy then software (at least when it comes to Linux)


Since Kraven no longer has time to do the prom socket mod, is anyone else offering this service for a HD-Tivo?

I'm inclined to try this hardware mod on my own (It's only a $1000 unit, right? :) ), but I'm sure there are others out here too nervous to try modding their unit themselves.

whackit
07-08-2004, 11:37 PM
I would also be interested in having my prom socketed as surgery makes me squemish. PM me if interested.

mattdb
07-23-2004, 05:14 PM
I would also be interested in having my prom socketed as surgery makes me squemish. PM me if interested.

Same here. HR10-250

steve90071
07-24-2004, 04:12 PM
Me too! I have a HD 10-250 Tivo.

MudShark
07-25-2004, 12:02 AM
Ok, from the rumor mill Kraven has stopped doing them? If so, I'm game to pick up where he left off. Have SMD reworkstaion and not affraid to use it. :)

If Kraven is still doing them, I have *NO* intentions of stepping on his feet!!

I currently only have the SA-2's firmware. So for the Direct Tivo people, and the HD Tivo people I need at least links to the 'enhanced' firmwares.

rc3105
08-02-2004, 06:23 PM
need a cheap prom mod?

check out this thread (http://www.dealdatabase.com/forum/showthread.php?t=36610&page=1&pp=5) out & donate $25

StanSimmons
08-02-2004, 06:39 PM
Ok, from the rumor mill Kraven has stopped doing them? If so, I'm game to pick up where he left off. Have SMD reworkstaion and not affraid to use it. :)

If Kraven is still doing them, I have *NO* intentions of stepping on his feet!!

I currently only have the SA-2's firmware. So for the Direct Tivo people, and the HD Tivo people I need at least links to the 'enhanced' firmwares.
http://www.dealdatabase.com/forum/showpost.php?p=157268&postcount=55

jasch
12-21-2004, 11:50 AM
I suppose the R10 need a prom hack also? Is anybody providing this service at this time (so I can ship my unit to be modified/returned).

Thanks

rc3105
12-21-2004, 04:34 PM
or wait about 6 months until there are enough people with 2.5's to make a sw exploit bounty feasable ;)

compwiz312
12-30-2004, 08:47 PM
I am no longer offering any PROM services. Sorry.

jasch
12-31-2004, 11:53 AM
I would love to take you up on your offer, but I guess the hack still does work with the R10 ...

compwiz312
12-31-2004, 02:27 PM
I would love to take you up on your offer, but I guess the hack still does work with the R10 ...

I can definetly do a PROM mod on a R10. AFAIK, there are no software only options to upgrade those units now.

jasch
12-31-2004, 03:08 PM
But the prom cannot be reprogrammed yet for the R10 right ?

compwiz312
12-31-2004, 03:27 PM
But the prom cannot be reprogrammed yet for the R10 right ?

That is false, the PROM can be reprogrammed for the R10, but it requires you to desolder it from the motherboard, reprogram it in a chip programmer and then solder it back to the motherboard.

hxmiller
01-11-2005, 10:40 AM
In case people have not seen so in the For Sale section of this board, I am now offering a PROM modification service with three options:

$40 - Simply reprogram PROM chip and solder it back onto the board (No socket)
$50 - Reprogram the PROM chip and install a standard PLCC32 socket onto the TiVo motherboard
$5 - purchase a preprogrammed hacked PROM chip, perfect for those who might have good soldering skills, but don't wish to pay $50 or more for a programmer


Please PM or e-mail me if you are interested.

Justin


Anyone gone this route?

Jamie
01-11-2005, 11:46 AM
Anyone gone this route?Justin's doing 1) for me on a 540 SA S2.5. I should have the box back next week. Ask me then if it works ;-)

ronnythunder
01-11-2005, 12:59 PM
jamie, just curious, why not option 2) for only $10 more?

ronny

Jamie
01-11-2005, 01:16 PM
jamie, just curious, why not option 2) for only $10 more? no particular reason. I'm assuming I'm unlikely to want to change the prom code again. Maybe that's foolish, but its a done deal now.

goony
01-17-2005, 09:17 PM
$5 - purchase a preprogrammed hacked PROM chip, perfect for those who might have good soldering skills, but don't wish to pay $50 or more for a programmerWhat series 2 DirecTivos is this prom good for? I have both HDVR2s and an SD-DVR40.

compwiz312
01-17-2005, 10:39 PM
What series 2 DirecTivos is this prom good for? I have both HDVR2s and an SD-DVR40.

A PROM mod is not needed for those model units, use killhdinitrd instead.

A PROM modificiation/socket is only needed for the following models (IIRC):
* Tivo Model # TCD540040
* TiVo Model # TCD540080
* TiVo Model # TCD540140
* Humax T800
* Humax DRT400
* Humax DRT800
* Humax DRT2500
* Toshiba RS-TX20
* Toshiba RS-TX60
* DirecTV TiVo (Directivo) R10


Justin

goony
01-18-2005, 01:50 PM
A PROM mod is not needed for those model units, use killhdinitrd instead.
<snip>Thank you very much!

compwiz312
01-21-2005, 04:22 PM
Unfortunetly I will not be offering my service until March for those interested as I will be traveling for three weeks next month for college music auditions. Sorry.

Thanks,
Justin

ride_red
02-12-2005, 03:45 PM
Received your email, thanks. Received the unit on Friday, came DOA.



Unfortunetly I will not be offering my service until March for those interested as I will be traveling for three weeks next month for college music auditions. Sorry.

Thanks,
Justin

JHM
02-19-2005, 12:46 PM
I have an old Phillips HDR212 that I modified and it has served me well.

I never found a need to subscribe to the Tivo service and just used it for timed recordings on a daily/weekly basis. I loved it!

With hopes of upgrading to some newer technology,
I jumped in without doing my homework and bought a Humax DRT800.

It seems that I can't do timed recordings (daily/weekly) without subscribing to Tivo :eek:

I would like to do the prom upgrade to my DRT800 so I can add the extra software mods for telnet, ftping and web tivo.

In the end, is my DRT800 usless unless I subscribe to Tivo?
I am a little embarassed that I didn't do my homework before buying it :confused: :rolleyes:

jasch
02-19-2005, 12:58 PM
It seems that I can't do timed recordings (daily/weekly) without subscribing to Tivo :eek:

Only (really old) Series 1 can do that. At that Time TIVO service was optional, and when TiVo service changed form optional to required, the old units were grandfathered.

The only way to get around the service these days, is to purchase a DVD unit, which has TiVo Basic for free (you have a 3-day guide, you have time-based recordings, but no season passes).

rc3105
02-19-2005, 12:59 PM
In the end, is my DRT800 usless unless I subscribe to Tivo?

pretty much. if you've got the skills to make it work your time is worth a lot more than the monthy fee...

alldeadhomiez
02-19-2005, 01:12 PM
http://www.tivo.com/2.1.4.asp
http://www.weaknees.com/burner_faq.php#compare

I think the reference to the SD-H400 is a mistake, as it is a (Series2.0) DVD player, not recorder. The RS-TX* recorders cost about $100 more than the DRT800, and include lifetime TiVo Basic service.

They might even get upgraded to 7.x someday. :rolleyes:

JrFaust
02-22-2005, 02:05 PM
Has anyone had this done to their R10 unit and any pictures of the hack, any unforeseen side effects, good or bad?

Lastly and I've been reading lots of post both current and out of date and they all seam to waver on weather DTV is or isn't going to activate the HMO. Realistically will they ever do this or is the prom the only way to go?

Thanks for any information,
Robert

kautrey
03-04-2005, 09:20 PM
I want to place an order for a few of the SST39s from mouser.com - and also want to get the correct socket.

Here's the SST39 I'm looking at: http://www.mouser.com/index.cfm?handler=displayproduct&lstdispproductid=503799

But I have no idea what type of socket to buy - surface mount? through-the-board? low-profile? fine pitch?

What sockets have others bought?

Thanks!

Kevin

mrblack51
03-05-2005, 04:11 PM
you want a surface mount PLCC32 socket, and your sst39 chip should also be plcc32

jkozee
03-23-2005, 01:49 AM
A PROM mod is not needed for those model units, use killhdinitrd instead.

A PROM modificiation/socket is only needed for the following models (IIRC):
* Tivo Model # TCD540040
* TiVo Model # TCD540080
* TiVo Model # TCD540140
* Humax DRT800
* Humax DRT2500
* Toshiba RS-TX20
* Toshiba RS-TX60


Justin

How about the Humax T800? Does this unit require a PROM mod, or can killhdinitrd be used instead?

mrblack51
03-23-2005, 01:17 PM
How about the Humax T800? Does this unit require a PROM mod, or can killhdinitrd be used instead?

i updated the post above

devildog
04-15-2005, 06:35 PM
I have an eprom programer (Wilem).
Can someone provide a modified prom image
test with for an S2 Dtivo?

Herb_Davis_Y2K
05-06-2005, 12:18 AM
I have the programmer, and plcc32 chip, what is the next step for prom-ing my r10? Thanks in advance.

flyinbryan
06-02-2005, 01:17 PM
I have a programmer and everything i need to socket my 50040 where can i get the prom image and or modz

earnric
06-04-2005, 08:12 PM
So is anyone out there offering this service (flashing the promm on an R10)?

I have the new R10, like the speed, but bummed that I can't get network - telnet/ftp/tivoweb on it.

It it just easier to buy a Philips 708 and do the hacking myself -- or send my box to someone to have it promm'd?

Thanks,

Rick
R10 -- with an old Philips Series 1 sitting in the garage.

jasch
06-05-2005, 11:11 AM
So is anyone out there offering this service (flashing the promm on an R10)?

Unfortunately no one. I even offered $50 for a R10 programmed promm several weeks ago. (just the chip, no need to install) without any takers on my offer

tbielawa
06-06-2005, 12:26 PM
I have a programmer and everything i need to socket my 50040 where can i get the prom image and or modz

From a previous post by ADH about PROM Release 2.25:


These are the changes I made:


958c = 14830004 -> 14840004 (disable prom sha-160)
a4c0 = 1043000a -> 1042000a (disable kernel check)
9f88 = 0c771ac1 00000000 0440ff95 -> 0c771a83 00000000 24020000 (skip memchk)
8974 = 10400011 -> 00000000 (enable debug msgs)

(yadda yadda, 1201(f) notice goes here, don't violate any copyrights)

Note that the debug message hack isn't necessarily a good idea on an SA, since it will be transmitting "junk" on the serial cable box control line.


I made these changes on a TCD540 over the weekend and they work as advertised with PROM Release 2.25. Let me know if you need help beyond this. This week I plan on finishing documenting what I have done, and putting all of the utilities used into a bootable CD along with the documentation.




I even offered $50 for a R10 programmed promm several weeks ago. (just the chip, no need to install) without any takers on my offer

I bought extra PROMs and I am willing to sell what I have left. However, I don't know if PROM Release 2.25 will work in the R10.

davidlallen
07-15-2005, 08:52 PM
There is an active conversation about resocketing series 2.5 over here (http://www.dealdatabase.com/forum/showthread.php?p=229598&posted=1#post229598)

JoeSchmuckatell
11-16-2005, 04:16 PM
Can anyone explain the type of heat gun used, I can imagine it was not a hair drier but a Thermal Gun. I have a Thermal Gun and it reaches Max 700F.

I understand you make a heat shield out of foil and apply heat until and mild presure to the chip until it pops off. Just curious about how long the thermal gun should be on the chip. I imagine it has a maximum storage temperature, probably a lot less than 700F.

Thanks,
Joe

PlainBill
11-16-2005, 04:45 PM
Can anyone explain the type of heat gun used, I can imagine it was not a hair drier but a Thermal Gun. I have a Thermal Gun and it reaches Max 700F.

I understand you make a heat shield out of foil and apply heat until and mild presure to the chip until it pops off. Just curious about how long the thermal gun should be on the chip. I imagine it has a maximum storage temperature, probably a lot less than 700F.

Thanks,
Joe

A heat gun used for removing paint (Harbor Freight Tools has them this week for under $10.00) will do the job.

There's a story about a guy carrying a violin case who asked a policeman how to get to Cagnegie Hall. The policeman answered "Practice, practice, practice!"

Get some scrap pc boards and practice on them. Any computer repair place should have plenty of dead boards. The 'texture' of the solder will change when it melts. Only when this happens should you try to move the chip. 'Mild presure' (sic) will result in lifted traces, and 'weeping and gnashing of teeth'.

PlainBill

tbielawa
11-16-2005, 06:15 PM
Can anyone explain the type of heat gun used, I can imagine it was not a hair drier but a Thermal Gun. I have a Thermal Gun and it reaches Max 700F.


From the PROM datasheet:



Absolute Maximum Stress Ratings
Ö
Surface Mount Solder Reflow Temperature:ÖÖÖĒwith-PbĒ units: 240įC for 3 seconds
Ö

JoeSchmuckatell
11-17-2005, 06:42 PM
Well I completed the PROM Socketing without any problems.

I used a piece of foil with a hole cut enough to expose the PROM chip leads and applied a heat gun for about 45 seconds. You can see the solder change and that was my indication to pull it off. It did not stick at all.

I then knocked down the few solder bumps on the pads and tinned the socket ever so lightly.

I placed the socket over the pads and using my trusty fine point soldering iron (set at 750F) I pressed down from the top of each lead.

The next step was to verify isolation from adjacent pins with a multimeter. Two of the contacts had a brief low resistance but it appeared to be a capacitance item and I'm surprised I only found two of those. I suspect they were for power.

I plugged the original PROM back in and turned on the unit and it was operational. I was very please that not only did I install the socket properly but the PROM survived the heat.

I did install the new PROM but I got the flashing power light action. I was under the impression that I could drop the modded PROM in and it would run just fine but I think I'll go back and do some reading. I probably need to modify the files on the hard drive, after I create a backup of course and restore the image to a new 160 Gig drive.

The original PROM is back in the machine and my wife is telling me to leave it alone, so I will until next week. Should take that long to set a plan of attack for the software mods. My end goal is to share recordings between my two DTiVos. My other is a DVR40 that was hacked just after 6.2 came out. I ended up placing the original 6.2 on the drive after the last drive died.

Joe

jasch
11-17-2005, 06:46 PM
The modified prom should work transparently. I mean, your TiVo would boot with either one. With the added benefit that you can hack the files on the TiVo if you have the hacked prom.

But other than that, the modded prom should let you use your TiVo even if you haven't modified any files on it.

JoeSchmuckatell
11-17-2005, 07:54 PM
The modified prom should work transparently. I mean, your TiVo would boot with either one. With the added benefit that you can hack the files on the TiVo if you have the hacked prom.

But other than that, the modded prom should let you use your TiVo even if you haven't modified any files on it.

Well I thought that too so I've been searching the threads and I didn't find anything that said it would run by it'self although looing at what the mods do I would thing it should run fine. I started thinking I needed to mod my drive files, specifically initrd and I was headed in that direction until I got your reply.

I will put the new modded PROM chip in tomorrow, right now the unit is recording SG1 and then some program for my wife.

Thanks for the feedback, saved me hours on the internet tonight.

Joe

jasch
11-17-2005, 08:57 PM
Well. That's why we are here for. At least you showed initiative, and searched in the forums before asking a question blindly

crackerjack
12-02-2005, 06:51 PM
OK all, I have done the mod and made an attempt at modifying the code to no avail. I have searched and searched around, but have yet to find the actual file to put back on as mine obviously does not work. Does ANYONE have the 2.25 bin file to program the SST PROM with for the TCD5400 series TiVo? Any sort of direction to a good file would help. I will be happy to post results. Is it bad form to ask for this file? It isnt illegal, is it? If it is, I am VERY sorry and embarrassed. If it isnt, then please send me a PM with the file and/or a link. Thanks in advance.

tbielawa
12-03-2005, 12:55 AM
OK all, I have done the mod and made an attempt at modifying the code to no avail. I have searched and searched around, but have yet to find the actual file to put back on as mine obviously does not work. Does ANYONE have the 2.25 bin file to program the SST PROM with for the TCD5400 series TiVo? Any sort of direction to a good file would help. I will be happy to post results. Is it bad form to ask for this file? It isnt illegal, is it? If it is, I am VERY sorry and embarrassed. If it isnt, then please send me a PM with the file and/or a link. Thanks in advance.

Check here:

http://www.dealdatabase.com/forum/showpost.php?p=197867&postcount=1

JrFaust
12-15-2005, 10:49 PM
Just wanted to say thanks to tbielawa for the prom upgrade kit.
With the knowledge I've gained here and TWC I was able to install the prom and hacks to get my R10 unit running with ftp, telnet, MVR, and TWP.

Thanks all.

solidblu
01-06-2006, 04:21 PM
I'd like to get a hacked prom for a directv r10 and install myself. You still producing these?


A PROM mod is not needed for those model units, use killhdinitrd instead.

A PROM modificiation/socket is only needed for the following models (IIRC):
* Tivo Model # TCD540040
* TiVo Model # TCD540080
* TiVo Model # TCD540140
* Humax T800
* Humax DRT400
* Humax DRT800
* Humax DRT2500
* Toshiba RS-TX20
* Toshiba RS-TX60
* DirecTV TiVo (Directivo) R10


Justin

bonafide
01-12-2006, 05:11 PM
I ditto solidblu's request. I sleepered my DirectTV S2 a couple years ago and would like to take advantage of some of the newer images. If no one is still doing this, then I would appreciate any other pointers that would help me get unmonte'ed and a bit more up to date...without comprimising the ability to execute hacks of course.

- bonafide

PlainBill
01-12-2006, 05:23 PM
I ditto solidblu's request. I sleepered my DirectTV S2 a couple years ago and would like to take advantage of some of the newer images. If no one is still doing this, then I would appreciate any other pointers that would help me get unmonte'ed and a bit more up to date...without comprimising the ability to execute hacks of course.

- bonafide
Here (http://dealdatabase.com/forum/showthread.php?p=196162&postcount=3), then here (http://www.dealdatabase.com/forum/showthread.php?t=43599).

PlainBill

rowdan
01-24-2006, 11:51 PM
A PROM modificiation/socket is only needed for the following models (IIRC):
* Tivo Model # TCD540040
* TiVo Model # TCD540080
* TiVo Model # TCD540140
* Humax T800
* Humax DRT400
* Humax DRT800
* Humax DRT2500
* Toshiba RS-TX20
* Toshiba RS-TX60
* DirecTV TiVo (Directivo) R10

ok i am assumeing the tcd540040 still requires a prom mod..... does any one still offer the sockting service?

also im thinking about buying a 2nd tivo, is there a list of modle numbers that are beter then the rest, or mabee a list of model numbers to stay away from...... oviously the ones listed here requiring the prom mod, but other that are good or not good.

Narf54321
01-25-2006, 02:02 AM
also im thinking about buying a 2nd tivo, is there a list of modle numbers that are beter then the rest, or mabee a list of model numbers to stay away from......

Since you mention the TCD540 (Series2.5 or nightlite model) I assume you mean standalone cableTV units. I'd personally recommend getting a decent used TCD240 model. These would specifically be TCD240040, TCD24004A, TCD240080, TCD24008A which are the common ones.

They're software moddable and seem to be fairly hardy. Be sure to get the remote control with it, too.

SoHoTrader
02-12-2006, 11:34 PM
I've TCD540040... Need to hack and I need PROM MOD KIT.. GOT it PM Me...

SoHoTrader
03-14-2006, 04:26 AM
Heeeeeeeeeeee Haaaaaaaaaaaaaaaaa

Hacked my TIVO Series 2.5 (TCD540040) with MOD PROM.....


Thanks ........... Everyone for the wonderful journey....

Offspring2099
03-14-2006, 06:10 PM
Where did you get the PROM kit and how much was it. I got the cursed TCD540040. Agh.... :(



EDIT: Git er done!!! I did mine today, and I didn't get burnt once.

Phreedom
03-22-2006, 05:06 PM
I've got an R10 and am interested in purchasing a non-r10 prom. Plz msg me.

gene203
04-06-2006, 10:10 PM
I have Series 2.5 (TCD540080), please email me at xxxxx anybody who can do the prom-socketing service.

Thanks.

EDT: I got the offer, thanks

M4tth3wV
04-09-2006, 03:43 PM
I have a: TCD540040.

Anyone still doing the PROM socket service?

PM please


Matt

anallyn
04-21-2006, 05:06 PM
good program

farlz
04-26-2006, 01:17 PM
Anyone in NYC who could do the prom-socketing service for a Toshiba rs-tx20?

donjuan01
04-26-2006, 03:13 PM
Anyone offering Prom socket Mod service for a Humax DRT400 please PM me

Divx-Trdr
04-26-2006, 05:06 PM
Ive got one of dem TCD540040 boxes modded with a 2nd 120GB HDD via MFStools, but now that my initial 1month's worth of trial TV guide ran out, I got no abilty to use the box in any way shape or form. Would the modded prom allow me to use the box again? (even for just manual recordings)?
It sucks having a $99 TIVO boat anchor

Narf54321
04-26-2006, 05:17 PM
PROM modding just allows you to add your own software without being overwritten by the initrd process.

To continue to get Tivo service, you need a subscription like the rest of us.

dustpuppy
05-08-2006, 05:56 PM
I've TCD540040... Need to hack and I need PROM MOD KIT..

could you please help and PM me.

Thanks

Sirshagg
05-19-2006, 03:36 PM
or wait about 6 months until there are enough people with 2.5's to make a sw exploit bounty feasable ;)

I for one would be willing to cough up some dough for this. Any plans for it in the near future?

rc3105
05-20-2006, 12:17 AM
I think everybody's holding their breath waiting to see what the cablecard-hd-s3's look like

jetspies
05-26-2006, 10:21 PM
Not directly TiVo-related, but I'm guessing someone can help me out and maybe some future hackers out at the same time...

Any suggestions on a decent surface mount rework station for prototyping and custom development? Most of my soldering revolves around art projects and I've started getting into embedded controllers and making my own PC boards. I'd love to be able to "borrow" chips and re-use them on my boards or socket chips that I'm worried I might fry on hardware that I'm experimenting with.

eBay is full of things that look pretty impressive to me, but I don't know which ones are crap and which ones are fine for occasional use.

thx.

satguymtl
05-27-2006, 02:24 PM
Anybody offering a modded PROM (and a socket if you have one)? TCD 540... I can do the installation here but I have no access to a programmer. Please PM me. Thanks!

Steventodd
05-28-2006, 12:48 AM
Can someone PM me with info on Prom Mod services?
Thank You

--

George2
06-05-2006, 05:29 AM
Is anybody doing PROM modding?? Preferably in the Los Angeles area. Please PM me.

Want to add another hard drive and also transfer recordings to PC. I have a DTV Tivo R10, TSN=521-0001 (Is that series 2 or 2.5?).

mnorton
06-05-2006, 02:31 PM
Iíve also got an R10 but I want to do the mod myself. I can get access to a burner (it would take some time ) and can do the socketing also.

I have a few questions:

1) The chip: Iíve seen some people reference this one:
SST39LF010
And some this one:
AM29LV010B-70JC (AMD)
So, which is the preferred? Iíve seen more references to the SST, but some recent posts about the AMD.

2) Alternate burning process?
Some of the messages and other threads that Iíve read seem to hint that there is a way of burning a new chip while itís in the unit. Do you simply boot from the existing prom and pop the new one in (system running, this sounds dangerous?), and login via serial port? If so, can someone point me to the code that I would need to run? Can this be done on the R10, or do I need an older model to support this?
If this were to be done without the burner, I would need an image, and the only one I can find is this one:

http://www.dealdatabase.com/forum/attachment.php?attachmentid=4129&d=1102223963

This appears to be for the standalone, not the Dtivo,

This looks like the right flash utility correct?
http://www.dealdatabase.com/forum/attachment.php?attachmentid=1703&d=1055428577

3) The tbielawa Kit:
It seems that tbielawa has done some excellent work putting this kit together. If so, would someone mind PMing a link to me? If this is taboo, please accept my apologies but it seems like a waste :o .


Thanks for your help,

Mark

ScanMan
06-09-2006, 12:40 PM
Probably a dumb question but here goes:

After I soldered the socket in and cleaned up a bit, was testing with an analog multimeter - got a little confused. If I'm checking adjacent (next to each other) points, there should be infinite resistance, i.e, the needle shouldn't move? And if the needle moves to 0 ohms, that means there is continuity b/w the pins (this is bad?) and I have a short/bad joint/bridge which needs correcting? Or do I have this backwards? Do I want 0 ohms or infinite resistance (no needle movement) between the points? Most adjacent points have infinite resistance; a couple have 0 ohms and 1 is in the middle...

Related question(s)

1. Do I need to have a replace_initrd kernel in place for the tivo to boot or will it boot the mod chip w/ stock kernel?

2. Also, assuming I didn't fry my original chip, could I stick that in the socket and boot up stock - or would that not work?

I'm just thinking in terms of testing and diagnosing problems, I would like to test boot the machine before I make kernel changes, etc., making things more difficult to troubleshoot. Basically, I just want to make sure my socket solder job is OK before I go ahead and make kernel/script changes.

mnorton
06-09-2006, 12:57 PM
Mr ScanMan

While some connections would read infinty, some may not. This is only going to depend on the components in the circuit between the pins.

I don't have all my parts yet but like you suggest, I plan to use the existing package to test the socket installation. This should give you a good idea if you were sucsessful or not. You may want to use a lupe or magnifier to inspect each pin.

I believe that the unit will boot with the modded chip and no further modifications.


Probably a dumb question but here goes:

After I soldered the socket in and cleaned up a bit, was testing with an analog multimeter - got a little confused. If I'm checking adjacent (next to each other) points, there should be infinite resistance, i.e, the needle shouldn't move? And if the needle moves to 0 ohms, that means there is continuity b/w the pins (this is bad?) and I have a short/bad joint/bridge which needs correcting? Or do I have this backwards? Do I want 0 ohms or infinite resistance (no needle movement) between the points? Most adjacent points have infinite resistance; a couple have 0 ohms and 1 is in the middle...

Related question(s)

1. Do I need to have a replace_initrd kernel in place for the tivo to boot or will it boot the mod chip w/ stock kernel?

2. Also, assuming I didn't fry my original chip, could I stick that in the socket and boot up stock - or would that not work?

I'm just thinking in terms of testing and diagnosing problems, I would like to test boot the machine before I make kernel changes, etc., making things more difficult to troubleshoot. Basically, I just want to make sure my socket solder job is OK before I go ahead and make kernel/script changes.

Vegas
06-09-2006, 01:06 PM
I'm just thinking in terms of testing and diagnosing problems, I would like to test boot the machine before I make kernel changes, etc., making things more difficult to troubleshoot. Basically, I just want to make sure my socket solder job is OK before I go ahead and make kernel/script changes.

The volt meter could read anything, depending on what components are in the path between the pins.

Here is what I did when I added the socket to my Tivo:

1. Used a good magnifying glass to check for solder bridges (found one) and cold joints.
2. Place the original chip in the socket. Tivo should boot. If not, recheck for bridges and cold joints. (or you fried the chip during removal.)
3. Place the modified chip in the socket. Tivo should boot. If not and you got past step 2, then there is a problem with the programing of the new chip.
4. Hack as desired.

Use a BIG magnifying glass and take your time with the soldering job.

Good luck, hope it works the first time.:)

Vegas

cheer
06-09-2006, 01:45 PM
1. Do I need to have a replace_initrd kernel in place for the tivo to boot or will it boot the mod chip w/ stock kernel?
I think it will boot, but it will nuke your hacks. Might as well try a replace_initrd kernel anyway.

2. Also, assuming I didn't fry my original chip, could I stick that in the socket and boot up stock - or would that not work?
That should work fine.

SiegeX
06-11-2006, 04:10 PM
Since you mention the TCD540 (Series2.5 or nightlite model) I assume you mean standalone cableTV units. I'd personally recommend getting a decent used TCD240 model. These would specifically be TCD240040, TCD24004A, TCD240080, TCD24008A which are the common ones.

They're software moddable and seem to be fairly hardy. Be sure to get the remote control with it, too.

I have a 540, 40GB model that I hacked to put in a 120GB drive but It seems like these puppies are going to take some time before they can be software hackable. I wouldn't mind sending it off for sombody to do the PROM mod but it appears nobody is doing it anymore. So here is my question, since I have a lifetime subscription, is that sub married to my 540 model? Or can I transfer that lifetime sub to a 240 model that I can find on fleabay? Thanks

Jamie
06-11-2006, 04:18 PM
I have a 540, 40GB model that I hacked to put in a 120GB drive but It seems like these puppies are going to take some time before they can be software hackable. I wouldn't mind sending it off for sombody to do the PROM mod but it appears nobody is doing it anymore.Check the for sale/trade forum. Someone posted there recently offering prom mod services.
So here is my question, since I have a lifetime subscription, is that sub married to my 540 model? Or can I transfer that lifetime sub to a 240 model that I can find on fleabay? ThanksIt's tied to your TSN. You can't transfer it, with a very few exceptions.

SiegeX
06-12-2006, 04:59 AM
Ok, thanks for the tip on the PROM service.

Let me prefrace this next question by reiterating that I do have a lifetime sub to tivo. I can't help but be curious about the following question. If you can hack a series-2 which has internet functionality (and perhaps series 1 does as well), then why do you need a subscription at all? If you have full control over the tivo, and all you need is the guide info I would be very surprised if that information was not freely available. Even if the Tivo guide servers had some sort of subscription check before allowing access, surely that check could be fooled with full access to the box or worst-case this information could be intercepted and made public by those like me who do have paid access. Is there more to tivo beyond the hardware than Im not giving it credit for?

cheer
06-12-2006, 07:35 AM
Let me prefrace this next question by reiterating that I do have a lifetime sub to tivo. I can't help but be curious about the following question. If you can hack a series-2 which has internet functionality (and perhaps series 1 does as well), then why do you need a subscription at all? If you have full control over the tivo, and all you need is the guide info I would be very surprised if that information was not freely available. Even if the Tivo guide servers had some sort of subscription check before allowing access, surely that check could be fooled with full access to the box or worst-case this information could be intercepted and made public by those like me who do have paid access. Is there more to tivo beyond the hardware than Im not giving it credit for?
Dunno, but as this is not a permitted subject you'll need to go elsewhere to explore it.

mnorton
06-21-2006, 09:45 PM
Iíve got two R-10ís and have read through all of the threads eagerly looking for as much information that I could absorb on the process. I felt that since I was going to do two of them that it was worthwhile buying a Willem programmer and doing it right.

As usual, I ordered more than enough SST-39s and have extras. I donít want to make any money at this and just want to give back to the forum that helped me get started in this endeavor. If you are interested, PM me, you can pay for the chip, socket and postage.

Understand that If you want to socket the board yourself, it can be done with practice, ChipQuik (for removal) and the right soldering technique (I've been practicing). If you donít know which end of the soldering iron to pick up :confused: :D, this project might not be for you to attempt personally, but I do know that there are folks offering this as a service. Also, your local EE should be able to help out or point you to the right person.

Iíve already tested the new programmer and it seems to be in working order. Iím looking forward to this weekend when I can spend some time working on socketing and replacement.

One question I do have: Has anyone managed to get 6.2 running on an R10? I'm thinking about trying AlphaWolf's 62small.mfs.

Thanks,

Mark

Jamie
06-21-2006, 09:50 PM
One question I do have: Has anyone managed to get 6.2 running on an R10? I'm thinking about trying AlphaWolf's 62small.mfs.
Unlikely. Series 2.5's have different hardware, and therefore different kernel and kernel modules. It might be you could get a Frankenstein version of 6.2 (e.g. 6.2. with 6.1 kernel and modules), but it is not clear to me why you would want to go that route. Are there things you can do with 6.2 that don't work in 6.1?

jasch
06-21-2006, 09:58 PM
AFAIK 6.1 is practically identical to 6.2. Except one is for R10's, the other for the rest of them

mnorton
06-22-2006, 01:17 AM
Unlikely. Series 2.5's have different hardware, and therefore different kernel and kernel modules. It might be you could get a Frankenstein version of 6.2 (e.g. 6.2. with 6.1 kernel and modules), but it is not clear to me why you would want to go that route. Are there things you can do with 6.2 that don't work in 6.1?

Point taken, For some reason I thought that 6.2 enabled some of the newer features like HMO... After checking around these features are only available natively in the SA. Thanks for straightening me out.

Mark

Jamie
06-22-2006, 01:21 AM
Point taken, For some reason I thought that 6.2 enabled some of the newer features like HMO... After checking around these features are only available natively in the SA. Thanks for straightening me out.

MarkActually HMO is available in both 6.2 and 6.1 with the superpatch. It's HME that is SA only.

mnorton
06-22-2006, 02:39 AM
Actually HMO is available in both 6.2 and 6.1 with the superpatch. It's HME that is SA only.

Thanks Jamie, it's all starting to fall into place.

Mark

mnorton
06-28-2006, 03:42 AM
So after some trial and error on an old motherboard, I’ve got some advice for those who wish to replace the PROM chip with a socket. Some of this advice is stated elsewhere in this thread by various people, I’m just letting you know what worked for me. I’ve been working on small electronics projects off and on for many years but am by no means a professional with a soldering iron.

I’ve managed to remove and re-install several sockets on the same motherboard and same pads with increasing quality and speed every time I do this.

Removal:
When removing the old chip, use Chipquick (http://www.chipquick.com). It has been discussed on this forum (thanks AlphaWolf) and uses an alloy to lower the melting point of the solder. This makes the removal of SMDs and thru-hole devices quite easy. You can order it from their website but if you have a Fry’s Electronics nearby, you can pick this up for about half what you would from the website (including shipping). This is probably the most important piece of advice about chip removal that I can offer. Without it, don’t even try unless you do SMD re-work for a living.

The soldering iron that you use for removal should be different (or at least a different tip) than the one that you use to replace the socket. For removal, I used my trusty Snap-On butane iron with a chisel tip. The wider the tip for removal, the better.

If you have to use solder braid for removal at any point, make sure that you coat it in flux first. This seems to speed the heat transfer and minimizes damage.

Speaking of flux, this is one thing that you can’t have too much of. Chipquick comes with a hypodermic filled with liquid flux. It also works well for the installation portion of the project. Mouser sells a flux pen that is also supposed to be good for this purpose.

Socketing:
Without the right iron, this can be quite tricky. I played around with different configurations and ended up buying a new Velleman 50W variable temperature soldering station. What’s surprising about this iron aside from the $20 price tag is that it works extremely well. I talked to the salesperson before I bought mine and he told me that the manufacturer was reputable for finding good tool designs and mass-manufacturing them to hit the low price point. I’ve found these on ebay under model number VTSS5U for about the same price including shipping.

The thing about the iron for this part of the job is just the opposite of removal. You need a very fine tip in order to minimize (or eliminate) collateral damage. You should be able to hit each pad one at a time.

BDMICRO (http://www.bdmicro.com/smt/) has a video of someone that has a serious technique, click on the first image for the video. :eek:

In my opinion, there are only 32 pins and they are on the inside of a socket, the best approach here is to hit each and every pin one at a time. rather than trying to zip across them.

I’ve read that you are better off with a small diameter solder. I’m currently using .035” which is the smallest that I’ve been able to find locally. It seems that .015” might be better for this.

The surface mount PLCC32 socket will normally come with a plastic bottom like the one shown:

http://vvsoft.fi/cm/prodpic180/PLCC32_Socket_SMD.jpg

It’s been said on this forum that it’s hard enough reaching the pins with the extra plastic in the way and you should trim out the bottom piece and I agree that it should be removed. I found that it’s much easier just to knock out the plastic by putting the socket upside down on a flat surface, placing a small screwdriver in the center and knocking it out in one blow.

After I got started on this project, I found this on Engadget: How-To: Make a surface mount soldering iron (http://www.engadget.com/2006/03/07/how-to-make-a-surface-mount-soldering-iron/). Not quite sure how well it works. Looks interesting :rolleyes:

Hope this helps,

Mark

SiegeX
06-28-2006, 04:09 PM
So im very interested in getting my series 2.5/nightlight PROM modded either by services here or a local electronics store. In either case, my question is once its modded, what directions do I follow in order to "hack" it? A link would be much appreciated.

Are there any compatability issues between the directions I should follow and the fact that this a series 2.5?

Finally, will doing this make it so that further updates/upgrades from Tivo will no longer work? I guess if worse comes to worse I can always put back the original PROM.

Thanks

mnorton
06-29-2006, 01:35 PM
Edited to prevent confusion and fustration this post has been mmmmh?

Mark

Jamie
06-29-2006, 02:08 PM
Once you start modding your box, you should no longer let it phone home as this may hose up your unit, undo your changes, alert D* that you are creative, cause your tivo to start recording random episodes of Matlock, or any combination of the above.This particular bit of advice is applicable to dtivo's, but not SA tivos. SA's must call in to tivo, unless you have some other way to get keys, certs + guide data.

mnorton
06-29-2006, 02:54 PM
This particular bit of advice is applicable to dtivo's, but not SA tivos. SA's must call in to tivo, unless you have some other way to get keys, certs + guide data.

My bad, I thought he was talking about a dTivo, not an SA.

cheer
06-29-2006, 03:54 PM
Once the PROM is modified the easiest thing to do is to change out the Kernel with one available at PTVupgrade.com ($5 for the CD). Then you can make whatever changes that you want. Is that right? I always thought that a PROM-modded Tivo required a kernel that's had initrd neutered via replace_initrd or somesuch and not one of the killhdinitrd'd kernels. But I've never had one, so maybe I am misremembering.

(It is at this point in our story that Jamie will waltz in, correct all of Chris's erroneous statements, educate thousands, and then wander off and produce another ty-ffmpeg patch as he assists bcc.)

Jamie
06-29-2006, 04:13 PM
Is that right? I always thought that a PROM-modded Tivo required a kernel that's had initrd neutered via replace_initrd or somesuch and not one of the killhdinitrd'd kernels. But I've never had one, so maybe I am misremembering.

(It is at this point in our story that Jamie will waltz in, correct all of Chris's erroneous statements, educate thousands, and then wander off and produce another ty-ffmpeg patch as he assists bcc.)No, you're right. I missed that. AFAIK, none of the S2 kernels on the ptvupgrade disk will work on a S2.5. The best bet is a custom built kernel (see this (http://www.dealdatabase.com/forum/showthread.php?t=46361)) or the stock kernel that has had the initrd replaced with replace_initrd. The nice thing about a prom mod is that you don't have to mointe to run a custom kernel.

SiegeX
06-29-2006, 08:23 PM
Sorry about not clairifying that I indeed do have a Stand Alone 2.5 unit. I'll definitely read more about the replace_initrd method. As for not allowing tivo to phone home, Ive actually networked Tivo to my Linux firewall via a USB wireless adapter and it gets its guide data through the internet. I'm hoping that I can still continue to do this. I have already done the harddrive upgrade from 40Gb to 120gb but im pretty sure this is a non-issue as far as PROM modding goes.

cheer
06-29-2006, 08:59 PM
Ive actually networked Tivo to my Linux firewall via a USB wireless adapter and it gets its guide data through the internet. I'm hoping that I can still continue to do this.Yep, sure can!
I have already done the harddrive upgrade from 40Gb to 120gb but im pretty sure this is a non-issue as far as PROM modding goes.Yep, sure is!

mnorton
06-30-2006, 12:37 AM
No, you're right. I missed that. AFAIK, none of the S2 kernels on the ptvupgrade disk will work on a S2.5. The best bet is a custom built kernel (see this (http://www.dealdatabase.com/forum/showthread.php?t=46361)) or the stock kernel that has had the initrd replaced with replace_initrd. The nice thing about a prom mod is that you don't have to mointe to run a custom kernel.

http://www.ptvupgrade.com/products/software/lba48/index.html

This link says that the LBA48 CD supports Series 2 including the following models:

[

Pioneer 810H and 57H DVR with DVD
Toshiba RS/TX models with DVD
TiVo Series2 TCD540 Models (the newest Series2 standalone units)
HUMAX Series2 standalone units
DirecTV/Hughes HR10-250 DVR with HDTV
DirecTV R10 (the newest Series2 DirecTV systems edit:6/30/06 File system is supported but the 6.1 kernel is not
Any Series2 Standalone Unit running version 7.X or newer of the TiVo OS
Any Series2 DirecTV Unit running version 6.X or newer of the TiVo OS


I've not tried it yet but I was planning on it this weekend.

Mark

cheer
06-30-2006, 01:12 AM
http://www.ptvupgrade.com/products/software/lba48/index.html

This link says that the LBA48 CD supports Series 2 including the following models:

[

Pioneer 810H and 57H DVR with DVD
Toshiba RS/TX models with DVD
TiVo Series2 TCD540 Models (the newest Series2 standalone units)
HUMAX Series2 standalone units
DirecTV/Hughes HR10-250 DVR with HDTV
DirecTV R10 (the newest Series2 DirecTV systems
Any Series2 Standalone Unit running version 7.X or newer of the TiVo OS
Any Series2 DirecTV Unit running version 6.X or newer of the TiVo OS


I've not tried it yet but I was planning on it this weekend.

Mark
Yes, the boot CD will work just fine. That is not the same thing as saying it has a compatible kernel included.

DaveTVo
06-30-2006, 03:10 PM
I'm interested in an R10 PROM if someone is interested in selling me one. Plz PM.

Dave

mnorton
06-30-2006, 04:52 PM
Yes, the boot CD will work just fine. That is not the same thing as saying it has a compatible kernel included.

Ouch, I bought the LBA48 CD thinking that it had the 6.1 kernel on it just looking at the page I referenced above :mad:

I did manage to update a Philips DSR-704 with kernel 3.1.5 so it was not a total loss.

Just for reference, here are the S2 kernels that are included on the LBA48 CD:

3.1.1C
3.1.5
4.0.1A
7.2.2

Thanks for the note.

Mark

Rapitharian
07-04-2006, 02:05 AM
After Getting a new R10 from DirecTV Tonight, my old RCA DVR80 Died.
I read several posts, including this one, looking for a way to get my HMO back up and running. Now I feel a bit lost.
Is there a way to add Telnet, FTP, MFS_FTP, and tivo web to my system without moding the prom?
Seems Monte might be the way. correct?
If I must go the Prom route could someone point me in the direction of some more detailed directions and maybe even a copy of the moded prom code.
I have the skills to do the soldering so all I need is direction to locate the correct chip to remove and the code that need to be applied.

Thanks,
Rap

drez
07-04-2006, 02:13 AM
You WILL need to flash the prom to add all those things, no software hack for Series2.5s.

I don't have a link/know any search terms you should use because I never looked into it but I know the code/info you need to flash your prom is here at ddb.

Cheer, PlainBill, Jamie,etc should be able to find a link or give you some terms.


Also, are you sure you have a compatible programmer for the PROM?

A Willem is usually what I see recommended around here.

Rapitharian
07-04-2006, 02:31 AM
Drez,
Thanks for the info.
I will wait on links or terms from the senior members.
Compatable Programer. Nope I will have to buy one along with the chip and scoket.

Rap

ScanMan
07-04-2006, 01:07 PM
I will wait on links or terms from the senior members.Why don't you try searching? If you did you might have found this (http://www.dealdatabase.com/forum/showthread.php?p=257650&highlight=r10+prom+mod#post257650) post (hint it's right in this thread - you might want to read the "Prom Socketing" thread before you actually do it :)). Just using the search term "r10 prom mod" would have led to this (http://www.dealdatabase.com/forum/showthread.php?t=36801&highlight=r10+prom+mod) gem as well...you've got some searching and reading to do!!!

Rapitharian
07-04-2006, 01:58 PM
Why don't you try searching?
I did just didn't seem to get the right combo of terms.
Searching is how I found the tread we are in now.


You might want to read the "Prom Socketing" thread before you actually do it :)). Just using the search term "r10 prom mod" would have led to this gem as well...you've got some searching and reading to do!!!
Thanks for the Help.
I found the first Post. Thanks for clearing up that the prom there is also for the R10.
The second post I did not find and will read in its' entirety before I make any changes.

Thanks Again,
Rap

jmayes
07-11-2006, 10:09 PM
I just did my R10 and used the 'Piggy-Back' method of stacking the new PROM over the OLD one, from what I have read lots of people have damaged or destroyed their boards from trying to remove the old PROM but most people do have the skills to do the soldering. This method may provide a solution for them.

I have attached a Step-by-Step How-to describing how to do it.
I hope it helps!
Jmayes

mnorton
07-12-2006, 03:06 AM
I just did my R10 and used the 'Piggy-Back' method of stacking the new PROM over the OLD one, from what I have read lots of people have damaged or destroyed their boards from trying to remove the old PROM but most people do have the skills to do the soldering. This method may provide a solution for them.

I have attached a Step-by-Step How-to describing how to do it.
I hope it helps!
Jmayes

Nice work. I can appreciate this as removing the old chip can cause some tense :eek: moments. I've found that using ChipQuik as AlphaWolf has pointed out does work well though.

Noticed that you are using the 2MB 90ns chip. I was wondering if the larger chips would work.

Mark

pentium101
07-12-2006, 06:50 AM
I just did my R10 and used the 'Piggy-Back' method of stacking the new PROM over the OLD one, from what I have read lots of people have damaged or destroyed their boards from trying to remove the old PROM but most people do have the skills to do the soldering. This method may provide a solution for them.

I have attached a Step-by-Step How-to describing how to do it.
I hope it helps!
JmayesInstead of your method, have you tried soldering 2 low-profile surface-mount PLCC sockets back to back?

You would still have to modify the pin 24 connection, but I would think that this would work.

jmayes
07-12-2006, 09:52 AM
Yes, the larger chips work just fine, that 2m chip was the only one I could find on the fly that fit the bill, since it's a double size chip I load the program twice (back-to-back) which allows the extra address pin to be high or low and things still work. I measured it to be low in the tivo but just to be safe I loaded the pgm twice.


I like the back-to-back socket idea! That could even be a item that could be sold to people with limited soldering skills. I will expore that idea. I did solder a socket piggy-back to the first unit I did and found it was extreamly hard to get up under the lip of the socket to do the soldering so I decided that job was not for the Nubies at all but the double socket idea just might work, will report back on that one.

Jmayes

jmayes
07-12-2006, 10:29 PM
As I said before I love the idea of the back-to-back socket method, it will allow even a novice to upgrade their TIVO with only one trace cut and one solder connection. I spent today making up a few proto-types of the back-to-back socket assembly and drew up some instructions for building it and installation.

I did run into some issues, first- the socket used on the bottom needs to have itís notch dug-out, using it backwards and upside down leaves the notch on the wrong corner and it wonít fit over the original prom with out the modification. 2nd, I built two protoís today, it turns out one would not work at all, the socket fit very loose over the original prom as it was a higher profile type, thankfully the 2nd one fit tight and worked great so you will need to test the socket you choose carefully, not all of them work.

Here are the full instructions,
Enjoy- Tivo Community,
Jmayes:)

drez
07-12-2006, 11:17 PM
Even though I don't have a Series 2.5, I'm grateful you've taken the time to outline your approach.

I actually feel I can do the piggyback method if I ever need to (if S2s ever become scarce)... I don't think I would have ever been confident enough to do actual soldering/send it off to anyone.

PlainBill
07-12-2006, 11:33 PM
Good job! My only suggestion - list the socket brand that works, and the one that didn't fit tight.

PlainBill

jmayes
07-12-2006, 11:41 PM
I Will post the info on the sockets as soon as I can.


Enjoy,
JM
;)

pentium101
07-13-2006, 05:42 AM
Jmayes, very cool!

It looks like this Mill-Max socket from Digikey (Digikey part number# ED80009-ND) should work nicely.

You can read about it here: http://dkc3.digikey.com/PDF/T062/0333.pdf

AlphaWolf
07-13-2006, 08:39 PM
Good info. I've been wondering why nobody has tried this before. Something else that might be worth looking into as a community project would be to identify a software exploit, no matter how obscure or difficult to pull off, that would allow arbitrary code execution.

Then add a switch to be able to switch to the new prom after the tivo has already booted, and then do an in-circuit flash.

jmayes
07-13-2006, 11:39 PM
:cool: A switch is no problem, just toggle the OE signal between the two proms with 1k pull-up resistors installed to each, I will post a hookup diagram when I get some time. I am on the road until Monday so I won't be able to do any quality work until then.

The rom is read one time on boot then there is no activity so making the switch will not cause any trouble, if the 37x original prom can be flashed then my socket jig would only be needed to do the first-hack-boot then flash the original prom then no additional prom would be needed any more. Many people say the 37x can't be in-circuit programmed but the datasheet says is can so this might be a feasible thing to try.


Also I looked at the sockets I used under the microscope today, no markings at all to tell who's they are, I can only tell you that they came from old motherboards so they are Taiwan or China made, we will have to order samples from a few manf's to figure out which sockets will work. The ones that work for sure are the lowest profile kind that the chip actually sticks out a little (when used correctly). If the chip goes into the socket and ends up lower then the sides of the socket then it will not work.


Hope that all helps!
Jmayes

rc3105
07-14-2006, 12:36 AM
nice pics jmayes



Good info. I've been wondering why nobody has tried this before.
oh, I imagine a couple of people have... (http://www.dealdatabase.com/forum/showthread.php?t=49499&highlight=modchip)
at this point you're very close to being able to implement a clip-on modchip



Something else that might be worth looking into as a community project would be to identify a software exploit, no matter how obscure or difficult to pull off, that would allow arbitrary code execution.
Then add a switch to be able to switch to the new prom after the tivo has already booted, and then do an in-circuit flash.
er, if you can switch between mb & clip on proms why flash at all?

as for sw explolits, see the modchip thread (http://www.dealdatabase.com/forum/showthread.php?t=49499&highlight=modchip) for why they're kept quiet


it's possible to flash 37's in-circuit but it's hazardous to mb health. if you're willing to cut a trace or three then that's not an issue



if memory serves the whole piggyback-flash process can be this simple

cut 4 pins (or traces)

piggyback modded prom

boot tivo with flashing utils

switch to mb prom, apply erase voltage, flash prom & verify

reboot to double check mb prom

remove piggyback prom & restore original pins


with a prepped disk image, piggyback clip and tools the whole process is less than 10 mins (which is why I don't think it's worth antagonizing TiVo by offering *****-friendly modchips)

gcherw
07-20-2006, 09:03 AM
Sonicos was offering to perform prom replacements in the "for sale" section however he has been less than responsive. I was all set to send him my 540's to be upgraded and asked him a couple of questions prior to shipping and I haven't heard from him since 7/7/06. Nonetheless, I didn't send my tivos to him. Is there anyone offering legit prom modding?

Blitz68
07-20-2006, 02:31 PM
Where is the program to flash on the new chips? Or can I buy preprogrammed chips?

richr69
07-20-2006, 05:14 PM
Does anyone know if the AMD eeprom Am29LV040B-120JD would work for the R10 DTivo? I have 2 of these and the eeprom in my R10 is currently the SST 37VF010 70-3C-NH.

Thanks.

labbie48
07-20-2006, 10:05 PM
I know the AMD AM29LV010B-70JC will work but not sure about the Am29LV040B-120JD although I can't see why not. They are basicly the same chip but the 40B has 4 megabytes of memory vs. the 1 megabyte in the 10B and is a lot faster @ 120nS vs. 70nS.

The one thing I question is the "D" at the end. This is unknown to me....
"C" indicates commercial, "I" industrial and "E" extended. What "D" means might be found by reading the data sheet for that chip.

In any event, if your unit has a socket, go for it. You can always reinsert the old chip if it doesn't boot. Maybe someone else on the forum can explain the "D" designation

cheer
07-20-2006, 10:49 PM
Wouldn't 120ns be SLOWER than 70ns?

ScanMan
07-20-2006, 11:00 PM
According to the data sheet here (http://download.siliconexpert.com/pdfs/2005/08/09/semi_ap/1/amd/flash%20memory/21354e2.pdf) the "D" designation is commercial with a Pb-free package. Can't help with compatability though, I've only used SST37's & 39's.

labbie48
07-21-2006, 12:13 AM
my bad, guess age is getting to me, - faster @ 70nS vs. 120nS

jmayes
07-21-2006, 10:12 PM
My tests are showing that 120ns chips will NOT work, could be just me but I ordered some 29bv10-120s and no joy, the only thing I can figure out is that 120ns is too slow, by the spec they should work otherwise.

Still looking for low-cost blanks, anyone know some that digikey carries?

JM

PlainBill
07-22-2006, 02:43 PM
IIRC, others have found Mouser Electronics (www.mouser.com) has a good supply of the parts.

PlainBill

satguymtl
07-22-2006, 04:50 PM
Many thanks to the member who sent me a flashed PROM and socket!

I found a local place that removed the old PROM and soldered in a new socket for $25 with a couple hours' turnaround time.

I followed the instructions to hack the kernel and replace the initrd. When I boot, it goes into a "Welcome" screen loop, never getting past it. Serial output just shows a couple of random characters before it reboots.

I put the original PROM and drive back in, and it boots up fine, so I know it's not the soldering job. Is the new PROM not working? Or did I mess something up in the kernel patch?

labbie48
07-22-2006, 10:05 PM
Try the hacked drive with the original Prom and see if it boots up....

cheer
07-22-2006, 10:52 PM
Try the hacked drive with the original Prom and see if it boots up....

I put the original PROM and drive back in, and it boots up fine, so I know it's not the soldering job.
Sure sounds like the new PROM is suspect.

Narf54321
07-23-2006, 08:40 PM
Still looking for low-cost blanks

When I socketed my own TCD540 unit, I got some SST39's from mouser.com for a couple of bucks each. I don't know how "low cost" you're looking for. I've had good luck with the SST39's because they're reprogrammable at 3v -- not so good with the sst37's.

SST39VF010-70-41-NHE (These are apparently the unleaded variety)

labbie48
07-23-2006, 10:05 PM
AKA "RoHS Compliant" products that contain ≤ 0.1% lead by weight.

For those looking for this chip the correct number is SST39VF010-70-4I-NHE. Mouser part number 804-39VF0107INHE.

ScanMan
07-23-2006, 10:10 PM
I followed the instructions to hack the kernel and replace the initrd. When I boot, it goes into a "Welcome" screen loop, never getting past it. Serial output just shows a couple of random characters before it reboots.More info needed. What is your tivo model and what exact instructions did you follow to hack the kernel - and most importantly, what kernel did you use? Series 2 kernels won't generally work on 2.5 models. Are you sure you used replace_initrd correctly? The replace_initrd binary typically takes three (3) arguments:

USAGE: replace_initrd <kernel filename> <new initrd image> <backup filename>
An example might be:

replace_initrd My540_vmlinux.px null_initrd.img My540_vmlinux.bak

In this example I want to take My540_vmlinux.px (a stock kernel extracted from unit first) and replace the initrd using alldeadhomiez null_initrd image; I specified the backup file name (if you omit it will just take your <kernel filename> and add a .bak). Now, My540_vmlinux.px is ready to be dd'd into the proper kernel location. You'll also want to fix your iptables/netfilter and create your rc.sysinit.author file.

[Edit:] corrected syntax order in the example!

drez
07-23-2006, 10:23 PM
Before you go through all that, jmayes posted that this kernel worked with his prom-modded R10:

http://www.dealdatabase.com/forum/showthread.php?p=259656#post259656
(jmayes' post)

http://www.dealdatabase.com/forum/showthread.php?p=200649#post200649
(original post of that kernel, jmayes' post only has a direct link to the attachment)

satguymtl
07-24-2006, 12:28 AM
Are you sure you used replace_initrd correctly? The replace_initrd binary typically takes three (3) arguments:

USAGE: replace_initrd <kernel filename> <new initrd image> <backup filename>
An example might be:

replace_initrd null_initrd.img My540_vmlinux.px My540_vmlinux.bak

In this example I want to take My540_vmlinux.px (a stock kernel extracted from unit first) and replace the initrd using Alldeadhomiez Null_initrd image; I specified the backup file name (if you omit it will just take your <new initrd image> and add a .bak). Now, My540_vmlinux.px is ready to be dd'd into the proper kernel location. You'll also want to fix your iptables/netfilter and create your rc.sysinit.author file.OK. FWIW, also a 540. In the usage above it says kernel name, new initrd image, and the bak. But in your example it appears to me that the image is first, followed by the kernel. Or I'm mistaken... ;) I'll try reversing them when I get home from work. Thanks for the pointers.

ScanMan
07-24-2006, 01:05 PM
But in your example it appears to me that the image is first, followed by the kernel.My bad; it was backwards in my example. You know, I just did this recently and I should have checked my notes before I posted b/c it wasn't real intuitive and I wrote it down...

Anyway, yes the 1st argument should be the kernel you want to replace the initrd and the 2nd argument should be the null_initrd. Sorry for the confusion and as drez suggested, you might want to try that kernel in the linked thread as a quick confirmation.

richr69
07-24-2006, 10:52 PM
Well, I finally decided to desolder the eeprom in my R10 ver 2.27. I got it off, cleaned the pads, and I am half way done soldering the socket. I was wondering for those that already did this, what are the changes in the 2.27 version. I found the chnages necessary for the 2.25, but not the 2.27. Has anyone made changes to teh 2.27?

Thanks

jasch
07-24-2006, 10:56 PM
FYI, the eprom I am using on my R10, works fine on my TDC54, so I guess 2.25 works with the R10 also.

mnorton
07-25-2006, 04:58 PM
FYI, the eprom I am using on my R10, works fine on my TDC54, so I guess 2.25 works with the R10 also.

The 2.25 PROM works or you can use the 2.27 image with the following modifications:

R10 v2.27.1, modify the 4 bytes at the following two file offset locations
(from -> to):
Addr 0x69A8: 14 83 00 04 -> 14 84 00 04
Addr 0x78DC: 10 43 00 0A -> 10 42 00 0A

Hope this helps,

Mark

richr69
07-26-2006, 12:15 PM
mnorton,

Thanks for the reply. However, when I did a search for 14830004 in the 2.27.1 prom, it appears in 2 locations 0x69A8 and 0xBD90. Do I need to change the data in both location or just the one you indicated i.e. 0x69A8.

Do you happen to know what is the md5 checksum is for 2.27.1? Are there different prom version i.e. 2.27 and 2.27.1, and if so, are the md5 checksums different. The reason I ask, I came across what suppose to be the correct checksum for 2.27 (c37c61654de112866ba55354189f954f), but I do not get the same checksum.

I just finished (yesterday) soldering my socket. I have not inserted the original prom back yet to make sure it boots up. I know I'm able to read the prom on the programmer, so I know its not fried. I'll probbaly try this tonight and hopefully it still boots up.

Thanks again.

satguymtl
07-26-2006, 03:37 PM
OK, did some more, uh, digging.

Stock PROM in the new socket and stock drive boot up. Stock PROM and hacked drive do not. Hacked PROM and hacked drive do not.

I then took the stock drive and applied the null-linuxrc image, netfilter-enable patch and rc.sysinit.author to run telnet and tivoftpd. It no longer booted with either PROM.

I dd'd the old kernel back (the .bak created by the replace_initrd script) and tried again, it still doesn't boot.

Finally I restored the drive completely from the backup I made earlier, and it boots with the both the stock and hacked PROMs.

I put the hacked OE drive back in the PC and tried to see what's going on with tivopart, but any command responds with "segmentation fault." So one of the steps I'm doing is causing a seg fault. I'm using a version of Damn Small Linux to apply the patches. Do I have to mount the TiVo drive (or the boot & root partitions) with tivopart prior to running the replace_initrd script and applying the patches?

ScanMan
07-26-2006, 04:44 PM
I then took the stock drive and applied the null-linuxrc image, netfilter-enable patch and rc.sysinit.authorDo you mean the stock kernel with the initrd nulled? Because you wouldn't want to apply the null-linuxrc image itself. Also, the netfilter-disable trick isn't enough...you need to replace iptables as described here (http://www.dealdatabase.com/forum/showthread.php?p=204669&highlight=iptables#post204669).

Do I have to mount the TiVo drive (or the boot & root partitions) with tivopart prior to running the replace_initrd script and applying the patches?You don't have to mount the drive to run replace_initrd but you do have to mount the drive with the active root filesystem to fix the iptables and create the rc.sysinit.author. Finally, a serial cable with console output can be very helpful in diagnosing these types of problems...

PlainBill
07-26-2006, 04:45 PM
Suggestion: 'Walk' the problem out one step at a time. You've already established a stock drive will work with both proms. I suggest using PTVupgrade's LBA-48 cd instead of another Linux version; this will remove one more variable from the process. While you're at it, also add dsscon=true console=1,115200 to the boot parameters (http://www.dealdatabase.com/forum/showthread.php?p=234467#post234467) and use a serial cable. This should allow you to see all boot messages. Troubleshooting problems without this is almost impossible.

A pointer to a custom kernel has been posted recently, I believe the syntax for null_initrd has also been posted. Use either of these and establish the system will boot with a modified kernel.

Once you have established you have a good kernel you can add other hacks.

PlainBill

mnorton
07-26-2006, 06:32 PM
mnorton,

Thanks for the reply. However, when I did a search for 14830004 in the 2.27.1 prom, it appears in 2 locations 0x69A8 and 0xBD90. Do I need to change the data in both location or just the one you indicated i.e. 0x69A8.

Do you happen to know what is the md5 checksum is for 2.27.1? Are there different prom version i.e. 2.27 and 2.27.1, and if so, are the md5 checksums different. The reason I ask, I came across what suppose to be the correct checksum for 2.27 (c37c61654de112866ba55354189f954f), but I do not get the same checksum.

I just finished (yesterday) soldering my socket. I have not inserted the original prom back yet to make sure it boots up. I know I'm able to read the prom on the programmer, so I know its not fried. I'll probbaly try this tonight and hopefully it still boots up.

Thanks again.

I would only change it at 0x69A8

I'm not sure how the two versions differ. I have 2.27 and have only made the changes as documented above. The checksums that I'm seeing are:


Stock 2.27: (32 Bit CRC: 0xEC4730E0) MD5: c37c61654de112866ba55354189f954f (same as what you found above)
Hacked 2.27: (32 Bit CRC: 0xD447F116) MD5: 95f03c6336df18e334b05c88f65907df

I'm using a 1MB chip in a Willem programmer and getting the 32bit CRCs from the software.

What are you seeing for 2.27.1?

mnorton
07-26-2006, 07:35 PM
Do you happen to know what is the md5 checksum is for 2.27.1? Are there different prom version i.e. 2.27 and 2.27.1, and if so, are the md5 checksums different. The reason I ask, I came across what suppose to be the correct checksum for 2.27 (c37c61654de112866ba55354189f954f), but I do not get the same checksum.


If you would, please PM me with the 2.27.1 bin file so I can run diff.

mark

satguymtl
07-26-2006, 08:14 PM
Wehey!

Thanks to some prompt and concise help via PM from a trusted and valuable member and contributor here, I managed to see my stupid error and get it working.

Thank you so very, very much!

Francesco

PS: FWIW, one small omission in my bootpage command to get the serial output working was throwing the error. I had misread the instructions too many times, when I should have just done exactly what it said.

richr69
07-27-2006, 10:46 AM
OK, I finally powered up my socketed R10 using the stock 2.27.1 prom last night. Everything works :) So I did not mess anything up.

The MD5 checksum I get on the stock 2.27.1 prom is
39708224A08491441A20BD41397C56C6 (CRC-32 4E3EDF2E). I obtained these values from a trial version of the "010 Editor" and doing md5sum on a SunOS.

I have programmed a SST37VF010 with the modified 2.27.1, but have not tried it yet. I also have 2.25 and 2.25 modified programmed in 2 other proms, so I can try them out too.

jmayes
07-27-2006, 10:58 AM
You need to replace the kernel on the hard drive before using the new chip.

Good luck,
JM

mnorton
07-27-2006, 11:18 AM
You need to replace the kernel on the hard drive before using the new chip.

Good luck,
JM

But the box can still boot with the modded chips without changing the kernel. I use this as a best practice and diagnostic step just to ensure that everythings working.

MN

jmayes
07-27-2006, 11:46 AM
Yes, they will boot to the sunshine screen but won't fully boot into tivo, the original kernal hangs with the new prom, at least that is what it does for me.

No sunshine screen = prom does not work or solder/connection problem.

JM

mnorton
07-27-2006, 11:08 PM
Yes, they will boot to the sunshine screen but won't fully boot into tivo, the original kernal hangs with the new prom, at least that is what it does for me.

No sunshine screen = prom does not work or solder/connection problem.

JM

That's strange, I didn't have any trouble booting thestock kernel with the modified PROM. Are you running an R-10 (6.1)?

MN

labbie48
07-28-2006, 12:35 AM
When I did mine, I had no problem either. You must be doing something wroung....

richr69
07-28-2006, 06:56 PM
If the prom mod is performed on the R10, is it still required to do the killhdinitrd on the stock kernel? I'm confused :confused:

Jamie
07-28-2006, 07:06 PM
If the prom mod is performed on the R10, is it still required to do the killhdinitrd on the stock kernel? I'm confused :confused:If you boot a stock kernel that still has the unmodified initrd, it will "clean" your root file system for you, eliminating all hacks. The PROM mod allows you to boot an unsigned kernel, or one that has been modified (e.g. with replace_initrd) after signing. You still need to get the initrd out of the way, if you want to hack; but killhdinitrd is not the tool for the job, on a series 2.5. You can either use replace_initrd, or boot a custom kernel.

If it still isn't clear, review this (http://www.dealdatabase.com/forum/showpost.php?p=192565&postcount=24) post to understand the chain of trust.

richr69
07-29-2006, 11:53 AM
I thought that is what the killhdinitrd was for. I used it on the original sd-dvr40 kernel (prom unmodified) and everything worked fine.

PlainBill
07-29-2006, 12:08 PM
I thought that is what the killhdinitrd was for. I used it on the original sd-dvr40 kernel (prom unmodified) and everything worked fine.
:rolleyes: :rolleyes: :rolleyes: Killhdinitrd works by bypassing the initrd. It depends on a fortuitous arrangement of commands, so only certain kernels can be exploited (3.1.5 kernel can; 3.1.5d, 3.1.5e, 3.1.5f, 6.2, and 7.1 cannot). It is useful chiefly on Series 2 systems.

The R10 is a Series 2.5 and (IIRC) a Series 2 kernel will not work. Use replace_initrd on the 6.1 kernel.

The bottom line: If Jamie says "Do it this way", but you think another way is better, Jamie is almost certainly right. (He might have been wrong once or twice, but I wouldn't bet on it.)

PlainBill

Jamie
07-29-2006, 12:16 PM
The bottom line: If Jamie says "Do it this way", but you think another way is better, Jamie is almost certainly right.I'd prefer that people understood what they were doing rather than blindly following instructions (mine or others). So questions about why things work the way they do are welcome.

I edited my post above to clarify that killhdinitrd is not the tool for the job on a Series 2.5. I left that part out, given the context, but without the context the post could have been unclear.

If you still don't understand, I'd suggest you go read that AllDeadHomiez post I linked to again (and again) until it sinks in.

mike_s
07-29-2006, 12:36 PM
I edited my post above to clarify that killhdinitrd is not the tool for the job on a Series 2.5. I left that part out, given the context, but without the context the post could have been unclear.Actually, in the context of this thread, it is more properly stated as "killhdinitrd is not the tool for the job on a TiVo with a PROM mod.

Jamie
07-29-2006, 12:42 PM
Actually, in the context of this thread, it is more properly stated as "killhdinitrd is not the tool for the job on a TiVo with a PROM mod.Killhdinitrd won't work on a Series 2.5, PROM mod or not.

jmayes
07-29-2006, 12:47 PM
Sorry, looks like my-bad. I tried a stock drive (stock kernel) again with the mod'd prom and it booted fine. I must have been holding my mouth wrong the first time.

Jmayes

mike_s
07-29-2006, 02:56 PM
Killhdinitrd won't work on a Series 2.5, PROM mod or not.And your point is?

This thread is about PROM mods, and is not exclusive to 2.5.

Nothing will work on a 2.5 without a PROM mod. Regardless of the architecture, if you have a PROM mod, it's easier and cleaner to simply neuter the initrd and boot directly from a single kernel. Hence, for 2.5 (with the required PROM mod) or any other TiVo which has a PROM mod, killhdinit is not the proper tool for the job.

Jamie
07-29-2006, 03:13 PM
And your point is?

This thread is about PROM mods, and is not exclusive to 2.5.

Nothing will work on a 2.5 without a PROM mod. Regardless of the architecture, if you have a PROM mod, it's easier and cleaner to simply neuter the initrd and boot directly from a single kernel. Hence, for 2.5 (with the required PROM mod) or any other TiVo which has a PROM mod, killhdinit is not the proper tool for the job.My impression is that killhdinitrd works fine on a S2 with a prom mod, using a compatible kernel. The issue is that killhdinitrd does not work with a S2.5, not that the prom mod interfers with killhdinitrd. I say this without having actually tried it. If, in fact, killhdinitrd does not work with a prom mod'd S2, I'm happy to admit the error.

jasch
07-29-2006, 03:46 PM
Hmm, this thread is confusing me. I have both a R10 and a TCD5400, both prom modded. I am sure I am using the same kernel on these units, as the one I am using on my DVDR-40's (killhdinitrt'ed).

Jamie
07-29-2006, 03:54 PM
Hmm, this thread is confusing me. I have both a R10 and a TCD5400, both prom modded. I am sure I am using the same kernel on these units, as the one I am using on my DVDR-40's (killhdinitrt'ed).It doesn't sound right. A S2 kernel shouldn't be able to work on a S2.5 (R10,540). Do a "uname -a" on all the boxes. If it is really the same kernel, the kernel build data and time should be identical on all of them.

jasch
07-29-2006, 03:57 PM
On my DVDR-40

Linux (none) 2.4.20 #22 Fri Feb 20 18:19:25 PST 2004 mips unknown

On my R10:

Linux (none) 2.4.20 #2 Wed Aug 18 16:23:47 PDT 2004 mips unknown

On my TDC5400

Linux (none) 2.4.20 #3 Sat Oct 30 15:38:51 CDT 2004 mips unknown

jasch
07-29-2006, 03:59 PM
Strange, I would have sweared they all came from the same file.

My other DVDR-40 has

Linux (none) 2.4.20 #22 Fri Feb 20 18:19:25 PST 2004 mips unknown

As well as my HR10-250

Linux (none) 2.4.20 #22 Fri Feb 20 18:19:25 PST 2004 mips unknown

So it seems my DVDR40's and HR10-250 have the same. My R10 and TDC54 has different ones...

Jamie
07-29-2006, 04:24 PM
Careful what you swear too :-)

Based on the date and time of the build, your 540 kernel is this (http://www.dealdatabase.com/forum/showthread.php?p=193493#post193493) one. I didn't lookup your R10 kernel, but I'd guess it is the stock kernel that you neutered with replace_initrd.

Again, I encourage everyone to read and re-read alldeadhomiez "chain of trust" (http://www.dealdatabase.com/forum/showpost.php?p=192565&postcount=24) post if there is still confusion.

mike_s
07-29-2006, 05:31 PM
My impression is that killhdinitrd works fine on a S2 with a prom mod, using a compatible kernel.Yes, and you can drive a nail with a rock. That doesn't make either the proper tool for the job.

Jamie
07-29-2006, 05:57 PM
Yes, and you can drive a nail with a rock. That doesn't make either the proper tool for the job.Fine.

The facts are: killhdinitrd will work on any S2 (prom mod or not). killhdinitrd won't work on any S2.5 (prom mod or not).It seems like a silly thing to have a dispute about.

venkathh
08-06-2006, 01:26 AM
Is the Piggy-Back method specific to R10s or can it be used on any SA2.5 ?

Thanks :)

linenoise
08-15-2006, 12:43 AM
What are the choices I have for modding a Toshiba RS-TX20 that was just updated to 7.3.1? I would like to be able to have BASh so I can add some remote codes that are not in there.

Do I have to replace the PROM, or is there software for this model yet?

mrpenguin
08-17-2006, 02:14 PM
it seems like the piggy-back method would/should/does indeed work on a tcd540. The pin 24 lead/trace is in a different location than it is in the R10 in the piggy documentation. I did one and it reacts properly, but... the one I have has 2.28.1 firmware originally and the 2.25 firmware I have found does not seem to work. I get in & hacks load, can telnet, but major other issues and tons of errors. could be my piggyback, but I am thinking more of the fw needs updating.

If anyone has 2.28.1 and would like to share, it would be most appreciated. Or, if anyone had a 2.28.1 and used a 2.25 and it worked, let me know so I know I am not going in the wrong direction.

Thanks

mrpenguin
08-19-2006, 03:37 PM
I have successfully pulled the 2.28.1 FW from the onboard chip by removing the piggy and running a modified flash39 (found in this board). Made 2 edits I found elsewhere and it works to boot the modified drive. I made a pair of piggie backs, one with new chip, one that is only a half-piggie with pin 24 attached to the proper point, so I can basically switch between chips.
When I boot up with the hacked chip, everything boots fine, but no picture. I remove the hack and put on the bypass one to use the onboard chip, and picture show up right away, and I can change channels. When I swap them back the picture continues to show untill the channel is changed, then it is gone until the chip is swapped again.

I am thinking that something in the 2.28.1 FW or something is checking something after full boot, or my piggie is not that great. Is it possible for the pig to boot fine, but not function 100%? I read where the chip is not accessed after full boot, but I have proof right here that is must be accessed after, or something.

If anyone has any tips on how to disassemble the FW, I'd appreciate a PM. Thanks

(edit - forgot to post some pertinant info)
In the kernel log, when the hack chip is on, I get tons of these errors in the kernel log:
Microcode readback error expected xxxxxxx got yyyyyyy
and many boxes "KFIR is hung! Resetting" in them. Once I change to the original chip, all errors end.
I have not changed the tivoapp. only using the hacked prom and kernels from other threads.

mrpenguin
08-19-2006, 06:23 PM
major update:

After messing around with this issue I decided to desolder the chip and socket the tivo instead of the piggy. once socketed, I put the chip I was using in the piggy into the socket. Everything worked perfect.

So, if you are going to try to piggy a 540, do NOT use MillMax Part # 940-99-032-17-400000, mouser part # 575-321794

The chip I used was SST39cf010-70-4i-nhe, mouser # 804-39vf0107inhe

I still believe the tivo does indeed use the prom chip after boot, as if it didn't, I should not have seen the issues I did, or a poor piggy, but I did triple check all contacts. whatever the reason, socketing is the way to go. the heat gun & tin foil works soooo good. used it to socket an old IDE raid pci card for prom burning and it just took a bit longer to heat up the tivo. thanks for the great ideas.

vasechka
08-22-2006, 12:58 PM
Hi,

I've got TCD540040. Prom version (label on chip says 2.28.1). I'm lucky enough, my dad was able to socket chip and he has programmers, etc at work so he got 2.28.1 prom on floppy. the only thing left is to change few bytes. Do you know what should be changed in 2.28.1? Can I use 2.25 prom found in this thread?

Thanks

ScanMan
08-22-2006, 01:11 PM
Can I use 2.25 prom found in this thread?Yes, you can definitely use the 2.25 prom; then you'll need a kernel that has the initrd replaced.

vasechka
08-22-2006, 01:29 PM
Yes, you can definitely use the 2.25 prom; then you'll need a kernel that has the initrd replaced.

Thanks for respond. Could you please point me to correct kernel, so I could download it? Also, during first or second call my Tivo downloaded and upgraded itself to software 7.3.1 does it change anything for me?

mrpenguin
08-22-2006, 01:49 PM
changes were found at TCF:

2.28.1 Changes:
6a70 = 14830004 -> 14840004 (disable prom sha-160)
79a4 = 1043000a -> 1042000a (disable kernel check)

7.3x download just means redo kernel and hacks, but means nothing to prom AFAIK.

ScanMan
08-22-2006, 01:56 PM
These (http://www.dealdatabase.com/forum/showthread.php?p=200649#post200649) kernels reportedly work (haven't used them) or you could extract the stock kernel from the tivo partition and run replace_initrd on it as described earlier in this thread. FYI, the replace_initrd program (here at DDB) is source only and would have to be compiled for linux; probably easier just to try those linked kernels...

satguymtl
08-22-2006, 03:20 PM
I'll likely ask this in the Newbie section, but seeing as it involves a hacked PROM I'll make a quick post here.

I finally finished installing all the hacks and patches on my 540, and sure enough was sent 7.3.1 while I was away for the weekend.

My question is: is it possible to boot from the PROM menu and copy the boot partition over as well as all the altered files from the old root? Or should I just pull the drive, apply the initial boot and netfilter stuff and then copy the altered files over?

Thanks

ScanMan
08-22-2006, 05:29 PM
So it sounds like you didn't write new bootpage arguments that included 'upgradesoftware=false'? The only way to boot from the PROM now would be if you changed the password with the 'crypto' command while you had a bash shell on the tivo; the default password is some random alphanumeric string - doubtful you'd be able to guess it. Looks like you'll have to pull the drive; make sure this time you protect yourself!

satguymtl
08-22-2006, 10:02 PM
No, I didn't. And you know, I knew 7.3.x was in the pipe... :o Oh, well, live and learn (yet again). If I did have the update blocked, then I could back things up from the PROM menu before the final reboot, correct?

mrpenguin
08-22-2006, 10:14 PM
no prom menu. but just telnet in when you see the 2am reboots and manually do the update. steps to manually do the update are all over. basically edit the installSW to block the reboot, copy the kernel, copy hacks, etc. reboot. but nothing to do from the prom menu. if you do the update right, it will reboot, load the new stuff and you are done, all is good.

satguymtl
08-22-2006, 10:18 PM
Cool. Yes, I've seen the steps all over, but didn't need them before [the next time]. :) I'll put the 'upgradesoftware=false' argument in my bootpage this time and know for next.

kelsirose02
08-26-2006, 08:37 PM
If you pull a prom from a series 2 do you still have to reprogram it for the 2.5?

ScanMan
08-27-2006, 01:12 AM
Yes, if you pull the PROM chip (presumably a SST37?) from an S2 you would still need to reprogram it with the [hacked] 2.5 PROM for it to work in the 2.5 series. There were significant changes to enable additional kernel checks and security mechanisms for unauthorized files in the 2.5 PROM that were different from previous PROM versions. Read more about it here. (http://www.dealdatabase.com/forum/showthread.php?t=36801)

kelsirose02
08-27-2006, 11:52 PM
Where can i get a programmer what do i need to program the chip myself?

mrpenguin
08-28-2006, 12:13 AM
I used an old SIIG IDE controller card, but I had to socket the card as well as the tivo.

mnorton
09-01-2006, 12:53 PM
Where can i get a programmer what do i need to program the chip myself?

If you are still looking for a programmer, this person has an ebay store:

http://stores.ebay.com/EPROM-Programmer_W0QQssPageNameZstrkQ3amefsQ3amesstQQtZkm

This is where I bought mine and was a good experience.

You are looking for the "Enhanced Willem EPROM Programmer". It has to be able to flash the PLCC32 chip format. If you get the standard programmer, you will have to buy a seperate adapter for this format. The programmer comes with a windows program that is used to read/write to a great deal of formats.

Once you have something that can read and write the chip, the easiest thing to do is to read the existing chip, make the changes to the code (depending on what version you are running) and flash to a new chip.

I believe that there are posts earlier in this thread that talk about the chip to use as a replacement.