PDA

View Full Version : DualTuner Prom Hack Released



mrpenguin
09-18-2006, 01:30 PM
With a bit of guidance, I have come up with a prom mod for the Dual Tuner 649 model, prom ver 1.06.3. The DualTuner prom uses a compressed image to store some of the bootup code, including the kernel image check. So, you will need to hex edit the bin, removing the bytes prior to the compressed image start. Then uncompress that image. Make the edit to that image and re-compress it, use gzip -9n to recompress it. Next I copied the hex from the new compressed image and pasted it where the old image was, you could probably use some dd or other unix command to do it, I just used the editor. Finally I made the one change to the rest of the BIN. Flashed it, and all worked.

I am sure there may be other methods, some that may be a ton more elegant than mine. Also, you will need to socket the board to flash the prom.

Here's the locations:

main image offset 8050 change 04400012 -> 00000000
inside comressed image, offset 2688, change 1043000A -> 1000000A
compressed image starts at offset C91C

cheer
09-19-2006, 12:13 PM
With a bit of guidance, I have come up with a prom mod for the Dual Tuner 649 model, prom ver 1.06.3.
Nice. Been thinking about getting my mom one of these, but wanted to hack it for her first. Thanks, flightlesswaterfowl!

ReidWings
09-26-2006, 12:02 PM
I don't have a 2.5 unit, so I'm not too familar with the PROM hacking problem. But for my own curiousity, does this hack release mean you don't have to solder anything and everything can be hacked with software? Or do you still have to do hardware modifications? Thanks :)

captain_video
09-26-2006, 02:24 PM
Also, you will need to socket the board to flash the prom.
What he said. You will need to unsolder the existing EEPROM and install a socket to accommodate the newly programmed EEPROM.

mrpenguin
09-27-2006, 06:41 AM
De-Soldering and either resoldering chip or socket is REQUIRED for this hack, along with a method to read/burn the new prom image. Also, this hack does nothing but allow the kernel to be changed. You will still need to fix the kernel after this hack is complete.

ocntscha
09-29-2006, 02:27 PM
So this method (http://www.dealdatabase.com/forum/showthread.php?p=259752) would't work?

mrpenguin
09-29-2006, 09:59 PM
it may, if you get the correct sockets that will work for that, the ones I got did not work, as mentioned later in that thread. few things though:

- You will need to read the original image off the chip that is on the board, cannot do that on the tivo
- Piggy requires a trace to be cut and wire soldered in
- socketing the chip is really quite easy, it just seems scary/hard, so why not?
- socket looks oh so much more professional
- successfull socketing will give you much pride

ocntscha
09-30-2006, 10:59 AM
- You will need to read the original image off the chip that is on the board, cannot do that on the tivoDoh! That's a show stopper all right. Unless a PROM image where made available online like for the Series 2.5 (http://www.dealdatabase.com/forum/showthread.php?p=197867). ;) ;)

bcc
09-30-2006, 01:50 PM
Doh! That's a show stopper all right. Unless a PROM image where made available online like for the Series 2.5 (http://www.dealdatabase.com/forum/showthread.php?p=197867). ;) ;)Actually I have written code to read the PROM image from a running tivo. Pretty simple.
There is the catch-22 that you would have to already have broken the chain of trust at least once to run the program.

sabu
10-20-2006, 02:53 PM
Does the DT use the same flash chip as the other series 2s?

mrpenguin
10-20-2006, 10:48 PM
physically? yes, same as the 540's, the standard SST 37vf010

mike_s
10-21-2006, 07:12 AM
Doh! That's a show stopper all right. Unless a PROM image where made available online like for the Series 2.5 (http://www.dealdatabase.com/forum/showthread.php?p=197867). ;) ;)How are you going to reprogram an eprom if you can't even read it? (i.e. reading one is a subset of being able to program one)

mrpenguin
10-21-2006, 04:32 PM
I used an old IDE controller card & its flash utility. you can also use an already socketed/hacked machine & swap the chip after bootup, then use flash util on tivo

RavenStL
12-25-2006, 05:54 PM
Does anyone sell the PROM's pre-programmed for the DT TCD649080 or TCD649180?

I also am verifying it uses the SST 37vf010 as somewhere I was reading of 39 series PROMS. Confusing to a noobie.

If you dont have a Pre-Programmed PROM, than is the steps?

Unsolder existing PROM

Read the program in Binary and write to disk.

Follow MrPenguins instructions using linux to alter the PROM.

Re-Program the PROM (Preferrably a new one? Or is the original one One-Time Programmable?)

Install a socket and insert your new prom.

Boot and pray, as with all tivo hacking.

Thanks for any help.

Narf54321
12-26-2006, 04:11 PM
Your steps are pretty much correct. Uninstall the original PROM (there seem to be a couple methods such as ChipQuik or HeatGun) , and solder in a PLCC32 socket. If you put the original socket back into the new socket and your Tivo boots up, congratulations.

The Tivo PROM is a SST37VF010. The only difference between the 37 and 39 series is that the 39's can be flash-programmed at 3.3volts (the 37's require 12volts for flashing).

Some of us prefer the 39's because they tend to be easier to deal with on finicky programmers and may possibily allow use of something like homieflash in the tivo itself -- Although its a kind of catch-22 where you need a modified PROM to be able to load homieflash on your Tivo in the first place.

There's another thread AFAIK with a modified Dual-Tuner PROM posted, already.

RavenStL
12-26-2006, 08:29 PM
Thanks. I have a proper Pace system to do the job.

I found that Mouser has the chips.

I also have 3 different Universal Programmers, so it should be an easy job.

Found the datasheet.

Can't find a PROM anywhere thats ready, but heck, they are $1.50 and The instructions above seem easy enough.

Thanks.

Jamie
12-26-2006, 08:56 PM
Thanks. I have a proper Pace system to do the job.

I found that Mouser has the chips.

I also have 3 different Universal Programmers, so it should be an easy job.

Found the datasheet.

Can't find a PROM anywhere thats ready, but heck, they are $1.50 and The instructions above seem easy enough.

Thanks.You don't need to spend a lot of money on a prom programmer. A socketed S2, or many IDE or network PCI cards can do the flashing for you. I guess if you have the programmer already, it isn't an issue though.

RavenStL
12-26-2006, 09:22 PM
Thanks for the advise. I repair research equipment, 3rd party. So we have to backup all the firmware on all the equipment we work on. (3rd party = OEM thinks you are the devil)

I have an old one that runs on a 286 to support some old stuff, even before I was born.

Newest is USB and windows interface. quite slick IMO.

The new-ness of doing the hacks is the tough part. The actual work I do everyday :)

I may end up not doing it as my parents are getting this standalone tivo. I have Dtv. They now dont want to "void the warranty" untill they use it a while. I do not see anything wrong with that idea, so I will be on hold for a while.

Dang, and I was getting all excited and ready :)

And ways, thanks for the help! Happy New Year!

mumcs01
01-28-2007, 07:15 PM
What utility did you use to extract the image from the PROM? I have a HD controller with one of these that I've extracted and put on a socket, but the flash utility from the manufacturer only will WRITE to the chip. What did you use to suck the image off so you could make the change?

mrpenguin
01-28-2007, 10:37 PM
a socketed 540 was used. Booted it up with the hacked 540 chip in it, then put the dual chip in it & used homieflash I think to read that flash, then put the 540 chip back in. I originally used the IDE card to write a 540 chip to a new one, I did then after that, read the original chip via the tivo prompt.

mumcs01
02-02-2007, 05:26 PM
Just out of curiosity, does anyone have a hacked PROM image available for the dual tuner? I seem to be able to write to SST39's all I want with my socketed IDE controller card , but I can't read out the original Tivo37. I know the thread http://www.dealdatabase.com/forum/showthread.php?p=197867 has a PROM image for the single tuner silverfaced?

MarkF
04-06-2007, 12:28 PM
So is anyone selling or installing the DT PROM?

ScanMan
04-06-2007, 01:04 PM
Check the "For Sale" section for a post by Omikron.

MarkF
04-06-2007, 01:12 PM
Thanks - I literally just hung up the phone after speaking to Omikron.

chrisamarx
04-26-2007, 08:46 PM
I have a series 2 SA (TCD649080) DT wich is a virgin unit (never had a subscription and waiting for user setup) and as far as I can read it still seems that even with a prom mod that you still can not bypass that setup and use it as a VCR (Date, Time, Channel recording) without setting up the service. If this is true whar are the requirements for service? can you do month to month or do you have so sign up for a minimum of a year?

Has anyone figured out how to use a box like this without service?
Thanks in advance for any info.

jt1134
04-26-2007, 09:56 PM
I have a series 2 SA (TCD649080) DT wich is a virgin unit (never had a subscription and waiting for user setup) and as far as I can read it still seems that even with a prom mod that you still can not bypass that setup and use it as a VCR (Date, Time, Channel recording) without setting up the service. If this is true whar are the requirements for service? can you do month to month or do you have so sign up for a minimum of a year?

Has anyone figured out how to use a box like this without service?
Thanks in advance for any info.

Tivo offers subscriptions with varying prices depending on whether or not you commit to a 1,2, or 3 year service commitment. See www.tivo.com for more details. They don't offer month-to-month any longer. No one here will offer help in modifying your tivo to work without a sub.

dante0173
03-16-2012, 10:47 AM
If any one needs the original prom or the modified here it is.
For my bad luck my tivo motherboard fail, so I couldnīt check if the modification works. Then I rescue this files and have some SST39 chips if somebody is interested.
You can check here http://www.dealdatabase.com/forum/showthread.php?56609-Master-PROM-Patch-Locations (master prom)

this are the files 74097410