Write Protecting the Prom

[milhouse]

Now that 2.5 is hacked we should all be write protecting the prom. Can sone please tell me what pin on what chip we need to lift, and where to tie it high or low. Since 2.5 receive updates via satellite, my biggest fear is the Tivo/DTV may send something down to hose the unit. We can all reload the drive if they find a way to screw that up, but recovering from a looped in the prom whould not be easy.

Thanks,

Milhouse.

[IWantMyDTV]

http://www.ssti.com/products/pdf/395-39LF-VFxxx-03.000-DS.pdf

[flipsoft]

I was thinking of doing this a while ago but I did not have the balls to try it out now that my wife has become attached to the tivo.

Did you write protect yours IWantMyDTV? Did it work?
Thanks,
flipsoft

[IWantMyDTV]

Nah, I plan on socketing my flash. Just waiting on the parts.

[Worf]

You could also try cutting the write enable line to the flash chip - if it can't be written, it's essentially write protected. You might awnt to splice in a switch so it's writable on command just in case you need to flash it in again.

[flipsoft]

Let me know how it goes.

Is the flash that easy to take off? I thought they were surface mount. Good luck.

flipsoft

[bufordw]

The flash is a PLCC. It is a surface mount in the Sonys. The best way to take these off is with a rework station. It uses hot air and will not burn the part or the board. (In theory)

The problem is that the stations are high dollar, so the average person wouldn't have access to socket the chip. I'm not saying it can't be done with a soldering iron but you stand a mighty good chance of tearing it up. There are 32 pins and you can't lift them like normal DIP chips.

[IWantMyDTV]

Yes, I have other reasons for socketing the flash. (And access to a rework station :p ) If all you require is to protect the flash, then this is not the route for you.

[kazymyr]

Worf: just cutting the WE pin and letting it float isn't good enough. We had this discussion a while back on AVSforum.

[bufordw]

Originally posted by kazymyr
Worf: just cutting the WE pin and letting it float isn't good enough. We had this discussion a while back on AVSforum.

I think your right....From what I can tell you should be able to cut pin 31 to isolate it, then jumper pins 31 and 32 (WE# and VDD respectively)

This should cause the chip to be in a write inhibit mode.

Any Thoughts?

[Chance]

It would be trash and no Flash! actually PLCC's for the most part are physically pretty durable and any brand/kind (save extremely cheap cheap junk-mostly manufactured for bulk high number junk anyhow and not as relavent) Look at end product as well and what the PLCC will be doing for function, all we care about are ones that are going to most likely programmed and reprogrammed before stable product and version of the ground and almost always in state of CONSTANT redesign and rework. and as I briefly touched on my first post in here I think it was even! I am not Linux familiar by any means yet and dont claim to know much at all most times I'll go so far as to say..lol I do believe tons can be done to remedy the simple Tivo bond between the units and thier control. Thinkin I wold just get my hands on a pile of new PLCC's and reporgram/program/whatever them yourself if a person had access to facilities as I asked back then! Well enough about that! I got the big snub out reply just bringing that up even couple months ago! Seems may be a good simple enough huge boost to all of this! Someone has to work or know buddy who does in a at least decent programming center, etc? Yeah? ...Going once.............

[Chance]

No sense in starting to clip pins and such as chance of getting correct ones very difficult yes? Dont believe there are right ones to do that at any rate..dont trash your working chip anyhow, all for killing some extra time with free or low cost to me extra chips of course! Any of the major mfgrs plcc 32 pins are pretty durable in respects to being reprogrammed and all a bazillion times of course but same time you will end up more than likely rendering most of the good working ones fly weights from ESD., etc.

[IWantMyDTV]

Chance:

What exactly are you trying to say? I'm not quite sure I understand you.

Did you notice that we have the PDF for the chip. Not at all hard to get. "A computer is a binary device." We know the exact pins to clip and bridge

[bufordw]

Chance: UUUHHHH???

I think the problem for selling programmed chips is getting the old one off and the new one on the mohterboard.

As far as clipping the lead. I am going to do this tonight (I think).
AS I am a hardware guy I have no problem clipping testing and then if it doesn't work, just solder a bridge to make it whole again.

If you go to the Data Sheet link posted by IWantMyDTV
http://www.ssti.com/products/pdf/39...x-03.000-DS.pdf

You'll see that that Forcing OE# low, CE# high, or WE#
high will inhibit the Write operation.

I am also thinking that a resistor between 31 and 32 will be fool proof. Later on in the document it gives conditions for the write enable and programming of the chip.

Anyone?

[Electron]

According to the chip specs we need to force the WE# Pin High to prevent writes.

To do without causing damage to the Unit we will probably have to cut the trace and tie the chip side to +5Vdc.

If you just tie the pin high and the unit tries to pull the pin low something is going to smoke. ( if the Pin is driven directly by another chip.

I will look at the circuit and make a determination of how and where to cut and jumper.

I developed the original mod for the DTC-100 HDTV unit to prevent it from taking updates to the firmware.

I seem to remember there were 2 flash chips and we will have to determine if 1 or both need to be modded.

Electron

[bufordw]

Electron:

WE# and VDD (3.6v input) are right next to each other. There is room to clip WE# at the chip. Then install a 3 pos switch to allow for updates later on.

Interesting about the second prom. Please let e know what you find out.

[Electron]

Just be extremley careful about cutting the pin on the chip.

It is likley to break off at the body and you are really in trouble.

Electron

[IWantMyDTV]

The SA had two flash chips from SST, the DTiVo has only one.

[GoneSilent]

One flash is the daves prom that he can flash on his own. The other is Tivos.

[bufordw]

Electron, No worries, I have all the right tools, "My dad was a TV repair Man" [I]From FAST TIMES AT RIDGEMONT HIGH

[hwac]

Well I have the chip out in new socket in place, now does anyone have a dump of the 2.00 prom so I can compare I dumped a 2.5 and a 2.0 and when I do a compare to the hacked bin, boy do they look different????
It looks like the we pin is controlled by a 3 output octal bus transceiver (lx 2445b) I am not going to lock mine because with socket and programmer I can change at any time, If it becomes a issue I will take the time to lock it down.

FYI if you have done any tsop reading (pre jtag) this thing is a snap tons of space!!!!!

[Chance]

Even on the cheap board that these are you can see that a socket was in the build and should have been on the them! Also those are done out of house I am sure as anything like that is. Hey hope it all works for you dont get me wrong but why micky mouse with it like that and turn it into a paint by number at the blind kids school! (nothing bad meant towards blind-have good buddy who is) and unless you have a well grounded ESD safe workstation and even then it's just asking for trouble. And probably about every manufacturer is guaranteed to have same build chip so not hard at all in that respect, just be nice to chit chat with someone with access to a decent programming center,e tc.

[bufordw]

Electron, I think I'm going to hold off the pin mod for now. I will do as you suggested and trace back from the chip. There may be a better place to add a switch.

I also want to see what others come up with. I might also take the thing into work and put the sucker in a socket as well. Oh well....


Thanks for the insight.

[Electron]

I have traced out the WE# on the Flash Chip (U49)

The pin is connected directly to the Power PC ( CPU ) pin 127
that is the R/-W that controlls the direction of the memory.

High = Read from Memory Low = Write to memory.

There is a PullUp Resistor tied to the pin.

And it goes to Pin 1 of U53 ( Octal Bus transceiver )
Pin 1 Is the Direction control ( This is an Input Pin )
A High sends A Data to B Bus ( Pin 2 to Pin 18 )
A low sends B Data to A Bus ( Pin 18 to Pin 2 )


The best place to cut the trace would be near the Power Pc Chip
Pin 127 so the Pull up Resistor keeps WE# on the flash High Preventing writes.

There is enough room to cut the trace and connect a wire for a switch between the cut traces to re enable the write function.

This is not recommended unless you are very good with a soldering iorn and very fine wire You could easily destroy your TIVO.

It would also be a bad mistake to tie the WE# Pin directly to VDD
as that would cause a direct short in the Power PC R/-W pin anytime it tries to write the memory.

I will post updated info shortly with pictures.

Electron

[hwac]

The easiest way I see it is, if you do pull chip to put socket on bend pin 31 on socket up so chip does not make contact, solder wire wrap to chip pin #31 and to bent socket pin #31 and your good to go, I looked at the traces on the board around the power pc chip and they are very small one wrong move and your toast!!!

[IWantMyDTV]

hwac: You got pm.

[bufordw]

Electron, I will have to break mine apart and take a look at what your talking about.

I agree that if you don't isolate WE# at the chip it would be a bad thing to tie it to VDD.

I have some 32 Gauge Kaynar wire. That should do the trick.

Problem is I am getting too old to see that small stuff without the help of my benchmount Hubbel Telescope!!!!!!!!!


Bufordw

[Electron]

I am afraid if people without the proper tools start trying to pull the surface mounted chip and replace with a socket there are going to be a bunch of dead Dtivos on the market.

The Socket is the same size as the white outline about 3/16" from the legs of the chip, If you look on the right hand side of the chip there are several via's that will be shorted to the pins of the socket. The layout of this PCB was not designed to have a socket installed.

A surface mount PLCC socket has the legs on the outside and they wont even touch the pads on the PCB ( The ones I have seen anyway ), A ThruHole PLCC socket may be able to be Kludged on but that is going to be pretty ugly, and if you pull and replace the chip it is likley to break off as only the points of the pins would be soldered to the pads.

Cutting the trace will be dangerous enough for most, But the tip of an X-acto blade will make short work of it.

Again I Stress I DON'T RECOMMEND THAT ANYONE START CUTTING TRACES OR PULLING CHIPS Unless you really have the proper tools and know how.

I am sure the same thing can be accomplished in the operating system of the DTivo, Somewhere there is code that can be modified to prevent the CPU from writing to the Flash at all.
This will be much easier to do and to reverse.


Electron

[hwac]

Electron

No the sockets you can buy are with the legs under the socket itself ( direct replacement , same footprint ) , a little tricky to install but if you have the right tools about 1/2 hour work , now after saying that, do not do this if you have no skills working on small items on a pcb ,you will ruin your tivo ..... i will try to take some photos today and post ( only problem is my dtivo and all it's acc is my 4.3 meg pix camera i only have a 1.2 right now so i can't get too close ) :(

Ps sockets are cheap $1.25 dtivos arent $146.00 ( at least mine was) don't screw with it if you don't know what you are doing

Ps_1 I think there is alot more to this prom thing, options are there but need to know how to access. maybe this has been covered but somethings have caught my eye when looking at the code.

[kheflw]

Electron, sorry to get off topic here but I saw your comment about protecting the DTC-100. I just got an RCA F38310 with the DTC-100 inside. I'm running an EMU system. Is this something I should consider?

[hwac]

kheflw no this was before you could use a hu zkt on a h or emu , now it should be no problem because you can extract this from a hu and patch a core file or a h card

this is a pic of my unit before drives go back in

[hwac]

here is the prom full from 2.5 xtreme

you have to change .txt to .hex to use