Looking for Tivo2.5 Prom Code

[Rapitharian]

Hello everyone.

I tend to be a Do-It-Yourselfer. I want to hack my new DTivo R10. I know the first step is to reprogram the Prom. Here is the problem, I have searched and can't seem to find the modified code. If someone could point me in the right direction with search terms I would appreciate it. I don't mind doing the reading and learning what I have to to do it right.
The second thing that would be helpful would be info about how to locate the Prom in the tivo so I know I am pulling the right chip.

Thanks,
Rap

[Rapitharian]

Found this guide doing a google search.
(Removed the link as not to confuse people. The link was to a hack for a Series 1 Tivo) 7/5/2006 6:42 EST
Is it possible to inline flash the R10 Prom.
If so should I use this guys ISO or can I find the files here at DDB.

Thanks,
Rap

[cheer]

Found this guide doing a google search.
http://tivo.stevejenkins.com/network_cd.html#_Toc101001755
Is it possible to inline flash the R10 Prom.
If so should I use this guys ISO or can I find the files here at DDB.
That's for Series 1 units, not the R10. Look in the PROM socketing thread.

[jmayes]

Yes, where can we find the bin file?

JM

[Rapitharian]

Ok the bin file can be found here:
http://www.dealdatabase.com/forum/attachment.php?attachmentid=4129&d=1102223963
The bin above says it is for a SA units I am told it works for both.
The bin only really has two changes in the code, as I understand it.
1df4: 14830004 -> 14840004 - ignores the PROM SHA-160 check. This is MuscleNerd's patch and it is only here for reference.

2b40: 1043000c -> 1042000c - ignores the kernel signature check. This is MuscleNerd's patch and it is only here for reference.

For a great explanation of what different settings do in the prom code see alldeadhomiez post:
http://www.dealdatabase.com/forum/showthread.php?t=27474&highlight=1042000c

The flash Utility can be found here:
http://www.dealdatabase.com/forum/attachment.php?attachmentid=1703&d=1055428577

I will post more info as I find it.

Rap

[Rapitharian]

Here is my shopping list.
These are some of the things I beleive I need to buy to do the job.
Could someone tell me if I am off track?

This is the AMD chip:
http://www.newark.com/NewarkWebCommerce/newark/en_US/endecaSearch/partDetail.jsp?SKU=08C4182&N=0
Some have suggested the SST39LF010 chip. Is this a better choice?

This is the socket...I think it is the right one, is it?
http://www.newark.com/NewarkWebCommerce/newark/en_US/endecaSearch/partDetail.jsp;jsessionid=QYXBGEBGID1MKCXDUY0SFFYK2OTCGIV1?SKU=66F8683&N=0

This is the programer I am looking at getting:
http://www.mcumall.com/comersus/store/comersus_viewItem.asp?idProduct=3154
The reason I am listing the programer is because it is the new True USB model. It no longer uses the parrallel port like the older models. I don't know if the flash utility will work with this model. Has anyone used this model before?


Thanks for the advice.

Rap

[jmayes]

Great link's RAP, Good to see all this info getting referenced in one spot, I have found most of it but took hours as you found to.

The next best info I found was here;
“Hacking the R10 in Jan 06”
http://www.dealdatabase.com/forum/showthread.php?t=46945&highlight=%27r10%27

However the kernel referenced in that thread does not appear current, was made early on for demo purposes so I am not sure if that is the best one for the job. Killintrnt says it does not work with 6.1 so getting someone’s custom kernel is the only way for us non-compiling people to go.

If something can shed light on the exact kernel to use it would be greatly appreciated!

JM

[ocntscha]

This is the AMD chip:
http://www.newark.com/NewarkWebCommerce/newark/en_US/endecaSearch/partDetail.jsp?SKU=08C4182&N=0

I don't have a Series 2.5 or an eeprom programmer but not to long ago I bought this IDE controller (http://www.newegg.com/Product/CustRatingReview.asp?Item=N82E16816124001) and horsed around with this flash utility and firmware (http://www.siliconimage.com/support/supportsearchresults.aspx?pid=31&cid=15&ctid=2&osid=0&) to transform it to the raid version of the card (http://www.newegg.com/Product/CustRatingReview.asp?Item=N82E16815124001) and back again. The flash utility I just linked to has an advanced mode which lets you do some low level stuff like erase the entire chip, hex dumps as I recall, and I think you could erase individual sectors and/or change individual addresses. Just lots of low level uninhibited power to do whatever you might want to do, write whatever you might want to into the eeprom. I even thought at the time I was horsing around with it that if the eeprom on that card was compatible with the Tivo eeprom the ide card could probably be used as an el-cheapo eeprom programmer for the tivo but never checked compatablility and kind of forgot about it until I saw the post above so I checked compabitilty and it does appear to me that it would work.

When you fire up the utility I linked to it gives you this menu..

The flash memory chip in use is not one of the following:
SST SST39SF010, SST39VF010, and SST39SF020
AMD Am29F010B, Am29LV010B, Am29F040B, Am29LV400B
STMicroelectronics M29F010B, M29W040B, M29W400B
SANYO LE28C1001DT
WinBond W29EE011 and W29EE512
Atmel AT49BV512, AT49LV040, AT29LV010
Select flash memory type:
1. AMD 29F010B/29LV010B 1Mb compatible
2. AMD 29F040B 4Mb compatible
3. AMD 29LV400B 4Mb compatible
4. SST 39SF010 1Mb compatible
5. SST 39SF020 2Mb compatible
6. WinBond 29EE011/Sanyo LE28C1001D 1Mb compatible
7. WinBond 29EE512 512Kb compatible
8. Atmel AT49BV512 512Kb compatible
9. Atmel AT49LV040 4Mb compatible
10. Quit
Command:

The eeprom they are currently shipping on that IDE controller is a M29W010B (http://www.st.com/stonline/books/ascii/docs/6546.htm) which according to its data sheet (http://www.st.com/stonline/products/literature/an/7088.pdf) is software and hardware compatible with chip the AM29LV010B on Rapitharian's shopping list above. So I used choice 1 in the menu above and away I went flashing it back and forth between raid/and non-raid and even erased the entire eeprom once.

I'm speculating that this IDE controller could have its eeprom removed, a socket installed onto it, and then its flashing utility could be used to flash Tivo firmware onto an eeprom instead of IDE controller firmware.

I don't know, maybe my idea is as full of holes as a piece of swiss cheese, if so hopefully Jamie will pop in and tell us so, he's good that way, but right now there you go, just a thought of mine for anyone who might be interested. I don't have a Series 2.5 myself so this idea is kind of useless to me, but if anyone is interested I could horse around with the flash utility some more to make sure you can write arbitrary data into the eeprom but I'm pretty sure already.

[Rapitharian]

ocntscha,

Got an Idea here, depending on your soldering skills.
If you can sacrifice the hardware, remove the eeprom and the install the scocket and chip.
Total cost for the socket and chip from Newark about $3.00.
Then you can tell the whole community if your Idea works.
If you don't want to or can't part withthe hardware let me know and I may buy one to do the testing.

Rap

P.S. - Still looking to see what the senior members think of the eeprom programmer I am looking at and if anyone has used this model and what they think of it.

[ocntscha]

Rap,

I can't spare the card, I bought it because I wanted to have 5 PATA hard drives in my Linux box at home. I'm using it and the Linux logical volume stuff to combine a couple pairs of smaller hard drives into 2 large file systems. Its a great IDE controller btw, but its in my home server, runs 24x7. Not to mention using the words skills and soldering in a sentence referring to me is really stretching the definition of skills. And again, I don't have a Series 2.5 myself.

So, if you want to pursue my idea your on your own. I really do think it would work. I'll horse around with the flash utility tonight in conjunction with the PROM bin file you linked to and make sure I can flash it in.

A really competent solderer ought to be able to do the whole operation of hacking their Series 2.5 Tivo for just $11.99 plus shipping. (http://www.newegg.com/Product/Product.asp?Item=N82E16815124001) You could flash the hacked tivo bin file into the eeprom on the IDE controller, desolder it from the IDE controller and replace the PROM in the Tivo with it. Now your Tivo's hacked. Then you could take the Tivo PROM, solder it onto the IDE controller, flash it with the IDE controller firmware and tada you've got a really nice IDE controller to boot (pun intended :) )

[Rapitharian]

Link to an issue many have had once they replace the drive in their tivo.
This deals with cutting down the seek noise of the drive.
http://www.dealdatabase.com/forum/showthread.php?t=50007

Rap

[ocntscha]

Ok Rap,

I did some testing of my IDE controller, its flash utility, and the Tivo BIOS. It works!! The flash utility will let me specify the Tivo2.25-SA-Hacked-Prom.bin file as input and it happily flashes it in no problem!! Just as if it is flashing in an actual IDE controller BIOS. It says its 8 sectors of some size I forget exactly, gives a status report sector by sector as it flashes something along the lines of..

flashing sector 1
flashing sector 2
...
flashing sector 8

Then it verifies each sector

verifying sector 1
verifying sector 2
...
veryifying sector 8

Success.

This is the exact behavior as when I'm flashing in an actual IDE controller BIOS.

Now unfortunately there doesn't seem to be a way to have the utility dump out the contents of the PROM to a file. I had intended on flashing in the tivo BIOS, dumping it out to a file, and then comparing to make sure the output file was the same as the input.

It won't do that but what it will let me do is specify an address in the PROM, then specify how many bytes to read and it will just give a hex dump of that area to the screen. So, I pulled up the Tivo2.25-SA-Hacked-Prom.bin file in a hex editor on another PC, then just did eyeball comparisons of some hex dumps from the flash utility having it read from sections at the beginning, around the middle, and the end of the PROM. Everything matched perfectly!

So I really do think this would work as a cheap, viable, Series 2.5 hacking method.

[Rapitharian]

ocntscha,
Thanks That is great news.
I guess I will order one and test it the rest of the way, as soon as the card and my chips arrive.

-Rap

[Rapitharian]

Jamie posted in this thread
It uses the ... linux kernel version ... 6.1 (2.4.20)
http://www.dealdatabase.com/forum/showthread.php?t=46655

Now, after searching, reading and some interpetation I have found that 6.1 and 6.2 use the same Kernel version (2.4.20).
This happens to be ths same kernel used by 3.1.5. All the info you could want about the kenel is here:
http://www.dealdatabase.com/forum/showthread.php?t=42325

Here is more on the subjects of Kernels:
http://www.dealdatabase.com/forum/showpost.php?p=233112&postcount=11

I will try to download and compile the Kernel if I can't find a copy else where.
Found it elsewhere. ptvupgrade.com sells CD's that contain tons of goodies. One of which is the kernel we want. it is on the boot CD.
http://downloads.ptvupgrade.com/Merchant2/merchant.mvc?Screen=PROD&Product_Code=LBA48DD&Category_Code=
and for $5.00 it is worth knowing you are getting a good Kernel.
They also sell Good images for $19.99 each.

-Rap

[Jamie]

Not all 2.4.20 kernels are alike, and a kernel for a Series2 model will not work on a Series 2.5.

[labbie48]

I think if you're looking for a kernel for a R10, you're going to have to find someone who is willing to part with a custom kernel. I don't think I've seen one offered here but I may be wrong.

[cheer]

ptvupgrade.com sells CD's that contain tons of goodies. One of which is the kernel we want. it is on the boot CD.
Nope, that kernel won't work for you. As Jamie mentions, you need a kernel specifically for the Series2.5 boxes.

[ozzy52]

Somebody correct me if I'm wrong but for a Series 2.5 Tivo my understanding is you don't need to go and acquire any kernel from anywhere. You hack your PROM and neuter whatever kernel you're already using with replace_initrd.

[Jamie]

Somebody correct me if I'm wrong but for a Series 2.5 Tivo my understanding is you don't need to go and acquire any kernel from anywhere. You hack your PROM and neuter whatever kernel you're already using with replace_initrd.Right. The only reason to use a custom kernel is if you want something extra beyond what the stock kernel offers (e.g. better network performance, a journaled root file system, etc).

[Rapitharian]

Thanks for the clarification.
I will use the replace_initrd.
Funny the more you read and discuss the clearer things get. :P
Now I see the differances between my 2 RCA dvr40's and my one dtv R10.

Thanks,
Rap

[jmayes]

Has anyone found/posted a binary for replace_initrd, I really don't want to go the compile route if possable, or is there a pre neutered kernel out there? I have searched up and down and can't quite finger it yet.

Thankx all,
JM

[Rapitharian]

Post number 90 on this thread has great links.
http://www.dealdatabase.com/forum/showthread.php?t=43911&page=6

Will look for a compiled Version, If I can't find it I will compile.
Update - Compiled a copy and I am waiting for the Author's permission to post. See the thread below for updates.
http://www.dealdatabase.com/forum/showthread.php?p=259441#post259441

-Rap

[jmayes]

:)

Using the prom from:
http://www.dealdatabase.com/forum/attachment.php?attachmentid=4129&d=1102223963 (From Post 5 of this thread)

And the Kernel from:
http://www.dealdatabase.com/forum/attachment.php?attachmentid=4196&d=1103774590 (By Alldeadhomiez)

I have my R10 up and going!!

It may not be the BEST combo but it does get the job done.

Thankx RAP and all the Expert help provided in this thread, it should prove useful for many others.

I also employed a piggy-back method of fixing the prom, a new programmed prom is simply soldered directly to the old one and two wire jumpers are added. No de-soldering or removing the old prom is required, I plan to post pix's and complete instructions soon on the prom socketing thread. This should be much easier for many people that are worried about killing their boards trying to remove the old prom.

Thankx again all,
JM

Also, 'Ocntscha', were you able to flash back to the original program or re-program the prom a 2nd time? Many of the boards that 'self flash' contain the actual flash program on the prom and the next (new) flash must contain the same code snippet or the card will not flash anymore (or work). All computer Motherboards work this way too.

[ocntscha]

Also, 'Ocntscha', were you able to flash back to the original program or re-program the prom a 2nd time? Many of the boards that 'self flash' contain the actual flash program on the prom and the next (new) flash must contain the same code snippet or the card will not flash anymore (or work). All computer Motherboards work this way too.Yes, after successfully experimenting with flashing in the Tivo PROM code I was able to then flash in the IDE controller BIOS. I know what you're saying, most firmware is in a certain format with a certain checksum or signature and generally a flash utility won't flash in anything not specifically for the particular card, motherboard, what have you, or I know what your saying too, maybe after flashing in the Tivo PROM the flasher might not think its an IDE controller anymore, or part of the necessary flash code might actually need to be stored on the PROM and so I wouldn't be able flash back in the IDE controller BIOS. In fact I may not have even performed this experiment of flashing in the Tivo PROM for fear of permantly killing my IDE controller where it not for something I'd done accidentally when I was playing with its flash utility when I first got the card.. The flash utility includes an option that lets you erase the entire prom and I accidentally chose that the first time I ever used the utility. So I knew if it didn't want to flash the IDE controller BIOS back in after flashing in the TIVO PROM code I could just erase it first. I'm telling you guys this is just a really bare flashing utility put out by the chip vendor which they've never really bothered to make user friendly and/or id10t proof. In fact you HAVE to read the included Word document it comes with for instructions to even use it successfully. You can't just fire it up and start picking menu options (which is what I originally did :D and how I originally erased the entire PROM :eek: ), there's no option in its menus to even flash in a file. In its interactive mode which is what you get by just firing it up there's options to do hex dumps, and change individual addresses of the PROM, check the PROM, or erase the entire PROM which is how I ended up erasing the entire PROM. But to actually flash in a file you have to specify it on the command line but nothing like /? , -h, --help even works for telling you how to use it. When I was experimenting last week I actually flashed it several times, going back and forth between TIVO and IDE controller code, erased it entirely once or twice, really gave it a work out to make sure I thought it could be successfully used for flashing PROMs for a Tivo.

[jmayes]

ocntscha, that is good to hear. It sounds like you have found the low-cost programmer many may want to use for this project.

My Tivo R10 up for 12 hours now, no problems at all, all patches and hacks installed.

:)
JM

[jmayes]

I have provided the how-to for the Piggy-back PROM replacement method here;

http://www.dealdatabase.com/forum/showthread.php?p=259690#post259690

Good luck to all!
Jmayes

[labbie48]

Nice job, I did it the old fashioned way which worked out really well but this is nice for those that are a little nervous about making a major assult on their R10's. Nice to have peeps like you around, keep up the great work.:) :) :)

[addicted4life]

Awesome job ! Now if I could just get one of those preprogrammed chips, I'd be ready to make the jump into this hacking DTivo, I'm new to it all and own a HR10-250 and 2 R10's. None hacked yet. I read an update is on the way for the 10-250 too !! What a good day :D

[jmayes]

I have perhaps more good news on the HR10-250, you don't have to do the PROM for that one, I have mine all hacked up and still using the original prom, read read read :)

Good luck
Jmayes

[jmayes]

It was suggested to use two back-to-back prom sockets to stack the 2nd prom. I love the idea so well that I made some proto's and documented the procedure. Since only one wire needs connected it could even be jamed into the eye-lit tight thus no soldering!

See all the info here,

http://www.dealdatabase.com/forum/showthread.php?p=259752#post259752

Enjoy,
Jmayes
:)

[Rapitharian]

addicted4life,

If you still want the Pre-programed proms look in the Sale Forum.
There is usually someone there selling them.

-Rap

[Rapitharian]

Trouble with mrv after disabling the DHCP client?
http://www.dealdatabase.com/forum/showthread.php?t=43375&highlight=mrv+hmo
There is a file called netconfig.tcl
Worked great in 6.2.

Updated drivers for USB 2.0 and the Linksys 200M V2.0.
http://www.dealdatabase.com/forum/showthread.php?t=38167

Need to build a serial cable for your S2 Tivo?
http://www.garysargent.co.uk/tivo/images/tivoserialcable.jpg

Updated S2 binaries for MSF_FTP
http://dealdatabase.com/forum/showthread.php?t=37602

Brain dump by me on the installation of MSF_FTP & joe. It is post #13.
http://www.dealdatabase.com/forum/showthread.php?t=49949

Hope everyone is finding all of this info useful.

-Rap

[kcdc]

Has anyone tried the "zipper" hack/patch on a prom hacked r-10?

I have the prom mod done now not sure what hacks or patches will work for it?

If someone could point me to the right direction I would appreciate it :)

thanks

[labbie48]

Go ask in the Zipper forum....

Has anyone tried the "zipper" hack/patch on a prom hacked r-10?

I have the prom mod done now not sure what hacks or patches will work for it?

If someone could point me to the right direction I would appreciate it :)

thanks

[kcdc]

Sorry let me rephrase, what hacks are can be sucessfully run after the eprom mod.

[cheer]

Sorry let me rephrase, what hacks are can be sucessfully run after the eprom mod.
Almost any. What hacks do you want to use? ("Zipper" is not a hack; it's a script for installing hacks.)

[kcdc]

I am wanting to unlock the HMO options, and use the tivoweb software. I seem to be finding older hacks and I am unsure if they will work for the R-10.

Just lost in all the post I guess.

Was hoping that someone who has an r-10 up and running would share what hacks they are having sucess with.

Thanks for your time

[cheer]

HMO/MRV/Tivowebplus/TyTool/mfs_ftp/etc. all work fine with the R10.