With a bit of guidance, I have come up with a prom mod for the Dual Tuner 649 model, prom ver 1.06.3. The DualTuner prom uses a compressed image to store some of the bootup code, including the kernel image check. So, you will need to hex edit the bin, removing the bytes prior to the compressed image start. Then uncompress that image. Make the edit to that image and re-compress it, use gzip -9n to recompress it. Next I copied the hex from the new compressed image and pasted it where the old image was, you could probably use some dd or other unix command to do it, I just used the editor. Finally I made the one change to the rest of the BIN. Flashed it, and all worked.
I am sure there may be other methods, some that may be a ton more elegant than mine. Also, you will need to socket the board to flash the prom.
Here's the locations:
main image offset 8050 change 04400012 -> 00000000
inside comressed image, offset 2688, change 1043000A -> 1000000A
compressed image starts at offset C91C
I don't have a 2.5 unit, so I'm not too familar with the PROM hacking problem. But for my own curiousity, does this hack release mean you don't have to solder anything and everything can be hacked with software? Or do you still have to do hardware modifications? Thanks
What he said. You will need to unsolder the existing EEPROM and install a socket to accommodate the newly programmed EEPROM.Also, you will need to socket the board to flash the prom.
Please don't PM me or any other members looking for personal assistance. You'll do better by posting (after you've exhausted the search feature, of course) and taking advantage of the collective expertise of the membership instead of a single individual that may or may not be able to help you. Thank you and enjoy your stay at DDB!
De-Soldering and either resoldering chip or socket is REQUIRED for this hack, along with a method to read/burn the new prom image. Also, this hack does nothing but allow the kernel to be changed. You will still need to fix the kernel after this hack is complete.
it may, if you get the correct sockets that will work for that, the ones I got did not work, as mentioned later in that thread. few things though:
- You will need to read the original image off the chip that is on the board, cannot do that on the tivo
- Piggy requires a trace to be cut and wire soldered in
- socketing the chip is really quite easy, it just seems scary/hard, so why not?
- socket looks oh so much more professional
- successfull socketing will give you much pride
Does the DT use the same flash chip as the other series 2s?
physically? yes, same as the 540's, the standard SST 37vf010
I used an old IDE controller card & its flash utility. you can also use an already socketed/hacked machine & swap the chip after bootup, then use flash util on tivo
Does anyone sell the PROM's pre-programmed for the DT TCD649080 or TCD649180?
I also am verifying it uses the SST 37vf010 as somewhere I was reading of 39 series PROMS. Confusing to a noobie.
If you dont have a Pre-Programmed PROM, than is the steps?
Unsolder existing PROM
Read the program in Binary and write to disk.
Follow MrPenguins instructions using linux to alter the PROM.
Re-Program the PROM (Preferrably a new one? Or is the original one One-Time Programmable?)
Install a socket and insert your new prom.
Boot and pray, as with all tivo hacking.
Thanks for any help.
2 HR20-100's with OTA (Thank GOD I didnt get a HR21)
3 HDVR2's with 6.2, Sub'd, Hacked and 160 gig Seagates.
1 HR10-250 with 250 WD and 300 Seagate, fully Hacked
3 HDVR2's with 6.2, Hacked and 160 gig Seagates.
Who doesnt have 7 Tivos? and with 5 computers, contain 2 Terabytes of storage medium in their house??
Thanks to all who makes up DDB!!!!!!!!!!!!!!!!!!!!!!!!!!!
Your steps are pretty much correct. Uninstall the original PROM (there seem to be a couple methods such as ChipQuik or HeatGun) , and solder in a PLCC32 socket. If you put the original socket back into the new socket and your Tivo boots up, congratulations.
The Tivo PROM is a SST37VF010. The only difference between the 37 and 39 series is that the 39's can be flash-programmed at 3.3volts (the 37's require 12volts for flashing).
Some of us prefer the 39's because they tend to be easier to deal with on finicky programmers and may possibily allow use of something like homieflash in the tivo itself -- Although its a kind of catch-22 where you need a modified PROM to be able to load homieflash on your Tivo in the first place.
There's another thread AFAIK with a modified Dual-Tuner PROM posted, already.