Page 1 of 2 12 LastLast
Results 1 to 15 of 27

Thread: DualTuner Prom Hack Released

  1. #1
    Join Date
    Nov 2004
    Posts
    221

    DualTuner Prom Hack Released

    With a bit of guidance, I have come up with a prom mod for the Dual Tuner 649 model, prom ver 1.06.3. The DualTuner prom uses a compressed image to store some of the bootup code, including the kernel image check. So, you will need to hex edit the bin, removing the bytes prior to the compressed image start. Then uncompress that image. Make the edit to that image and re-compress it, use gzip -9n to recompress it. Next I copied the hex from the new compressed image and pasted it where the old image was, you could probably use some dd or other unix command to do it, I just used the editor. Finally I made the one change to the rest of the BIN. Flashed it, and all worked.

    I am sure there may be other methods, some that may be a ton more elegant than mine. Also, you will need to socket the board to flash the prom.

    Here's the locations:

    main image offset 8050 change 04400012 -> 00000000
    inside comressed image, offset 2688, change 1043000A -> 1000000A
    compressed image starts at offset C91C

  2. #2
    Join Date
    Nov 2004
    Location
    Gurnee, IL
    Posts
    2,385
    Quote Originally Posted by mrpenguin View Post
    With a bit of guidance, I have come up with a prom mod for the Dual Tuner 649 model, prom ver 1.06.3.
    Nice. Been thinking about getting my mom one of these, but wanted to hack it for her first. Thanks, flightlesswaterfowl!
    --
    Christopher D. Heer
    Quote Originally Posted by Oscar Wilde
    Perhaps, after all, America never has been discovered. I myself would say that it had merely been detected.

  3. #3
    Join Date
    Feb 2005
    Posts
    51

    random question

    I don't have a 2.5 unit, so I'm not too familar with the PROM hacking problem. But for my own curiousity, does this hack release mean you don't have to solder anything and everything can be hacked with software? Or do you still have to do hardware modifications? Thanks

  4. #4
    Join Date
    Feb 2002
    Posts
    6,414
    Also, you will need to socket the board to flash the prom.
    What he said. You will need to unsolder the existing EEPROM and install a socket to accommodate the newly programmed EEPROM.
    Please don't PM me or any other members looking for personal assistance. You'll do better by posting (after you've exhausted the search feature, of course) and taking advantage of the collective expertise of the membership instead of a single individual that may or may not be able to help you. Thank you and enjoy your stay at DDB!

  5. #5
    Join Date
    Nov 2004
    Posts
    221
    De-Soldering and either resoldering chip or socket is REQUIRED for this hack, along with a method to read/burn the new prom image. Also, this hack does nothing but allow the kernel to be changed. You will still need to fix the kernel after this hack is complete.

  6. #6
    Join Date
    Feb 2005
    Posts
    359
    So this method would't work?

  7. #7
    Join Date
    Nov 2004
    Posts
    221
    it may, if you get the correct sockets that will work for that, the ones I got did not work, as mentioned later in that thread. few things though:

    - You will need to read the original image off the chip that is on the board, cannot do that on the tivo
    - Piggy requires a trace to be cut and wire soldered in
    - socketing the chip is really quite easy, it just seems scary/hard, so why not?
    - socket looks oh so much more professional
    - successfull socketing will give you much pride

  8. #8
    Join Date
    Feb 2005
    Posts
    359
    Quote Originally Posted by mrpenguin View Post
    - You will need to read the original image off the chip that is on the board, cannot do that on the tivo
    Doh! That's a show stopper all right. Unless a PROM image where made available online like for the Series 2.5.

  9. #9
    Join Date
    Nov 2002
    Posts
    1,077
    Quote Originally Posted by ocntscha View Post
    Doh! That's a show stopper all right. Unless a PROM image where made available online like for the Series 2.5.
    Actually I have written code to read the PROM image from a running tivo. Pretty simple.
    There is the catch-22 that you would have to already have broken the chain of trust at least once to run the program.

  10. #10
    Join Date
    Jan 2004
    Posts
    2

    Chip & Socket

    Does the DT use the same flash chip as the other series 2s?

  11. #11
    Join Date
    Nov 2004
    Posts
    221
    physically? yes, same as the 540's, the standard SST 37vf010

  12. #12
    Join Date
    May 2004
    Posts
    247
    Quote Originally Posted by ocntscha View Post
    Doh! That's a show stopper all right. Unless a PROM image where made available online like for the Series 2.5.
    How are you going to reprogram an eprom if you can't even read it? (i.e. reading one is a subset of being able to program one)

  13. #13
    Join Date
    Nov 2004
    Posts
    221
    I used an old IDE controller card & its flash utility. you can also use an already socketed/hacked machine & swap the chip after bootup, then use flash util on tivo

  14. #14
    Join Date
    Nov 2004
    Location
    St Louis
    Posts
    206
    Does anyone sell the PROM's pre-programmed for the DT TCD649080 or TCD649180?

    I also am verifying it uses the SST 37vf010 as somewhere I was reading of 39 series PROMS. Confusing to a noobie.

    If you dont have a Pre-Programmed PROM, than is the steps?

    Unsolder existing PROM

    Read the program in Binary and write to disk.

    Follow MrPenguins instructions using linux to alter the PROM.

    Re-Program the PROM (Preferrably a new one? Or is the original one One-Time Programmable?)

    Install a socket and insert your new prom.

    Boot and pray, as with all tivo hacking.

    Thanks for any help.
    2 HR20-100's with OTA (Thank GOD I didnt get a HR21)
    3 HDVR2's with 6.2, Sub'd, Hacked and 160 gig Seagates.
    1 HR10-250 with 250 WD and 300 Seagate, fully Hacked
    3 HDVR2's with 6.2, Hacked and 160 gig Seagates.
    Who doesnt have 7 Tivos? and with 5 computers, contain 2 Terabytes of storage medium in their house??
    Thanks to all who makes up DDB!!!!!!!!!!!!!!!!!!!!!!!!!!!

  15. #15
    Join Date
    Jan 2005
    Location
    Narnia
    Posts
    1,266
    Your steps are pretty much correct. Uninstall the original PROM (there seem to be a couple methods such as ChipQuik or HeatGun) , and solder in a PLCC32 socket. If you put the original socket back into the new socket and your Tivo boots up, congratulations.

    The Tivo PROM is a SST37VF010. The only difference between the 37 and 39 series is that the 39's can be flash-programmed at 3.3volts (the 37's require 12volts for flashing).

    Some of us prefer the 39's because they tend to be easier to deal with on finicky programmers and may possibily allow use of something like homieflash in the tivo itself -- Although its a kind of catch-22 where you need a modified PROM to be able to load homieflash on your Tivo in the first place.

    There's another thread AFAIK with a modified Dual-Tuner PROM posted, already.

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •