Page 2 of 2 FirstFirst 12
Results 16 to 25 of 25

Thread: cci bytes

  1. #16
    Join Date
    Jan 2004
    Location
    n.h. usa
    Posts
    955
    ok i have upgraded and they sseem to work.. encryption is off and cci is not set after recording but i found the locations to check in the original tivoapp by converting the offset to hex so in the cases above i found them at

    2568d0
    2568f4
    d763d0

    i believe this is because it was not running in memory

    these locations when looked at in hedit on windows
    show the correct 30b000ff and 00e08821 and 30b000ff

    so that is probably why it works.. no just need the 30 sec skip and backdoor patches
    if anyone want the original tivoapp for 11.0b-01-648 let me know

  2. #17
    Join Date
    Dec 2004
    Posts
    831
    Quote Originally Posted by pdd View Post
    If you open up your tivoapp in a hex editor you can check.

    Code:
    VMA/HEX			Orignial Value	New Value
    0x00651E1C/0x00251E1C	30B000FF	00008021  
    0x00651E40/0x00251E40	00E08821	24110000 
    0x01177870/0x00d77870	30B000FF	00008021
    If the original values match then you should be ok to patch with those values.

    I can't confirm this because I don't have your version of tivoapp.
    First of all, let me confirm these are the values for the THD running 11.0b, correct? Secondly, does anyone have a link to a hex editor compiled for the TiVo (S3 class, of course)?
    Having trouble with TyTool? Try TyTool Documentation
    Need to hack an S3 / THD? Try S3 Hacking Script

  3. #18
    Join Date
    Dec 2004
    Posts
    831
    Quote Originally Posted by lgkahn View Post
    ok i have upgraded and they sseem to work.. encryption is off and cci is not set after recording but i found the locations to check in the original tivoapp by converting the offset to hex so in the cases above i found them at

    2568d0
    2568f4
    d763d0

    i believe this is because it was not running in memory

    these locations when looked at in hedit on windows
    show the correct 30b000ff and 00e08821 and 30b000ff

    so that is probably why it works.. no just need the 30 sec skip and backdoor patches
    if anyone want the original tivoapp for 11.0b-01-648 let me know
    And just to make sure I follow you, as well, you have an original S3, running 11.0b? So the upgrade values would be

    Code:
    Hex		Old Value	New Value
    002568D0	30B000FF	00008021  
    002568F4	00E08821	24110000 
    00D763D0	30B000FF	00008021
    Having trouble with TyTool? Try TyTool Documentation
    Need to hack an S3 / THD? Try S3 Hacking Script

  4. #19
    Join Date
    Aug 2004
    Posts
    4,075
    Quote Originally Posted by lrhorer View Post
    ... Secondly, does anyone have a link to a hex editor compiled for the TiVo (S3 class, of course)?
    I'd recommend you look at tvapppatch. 11.0b patches for tvapppatch were posted here.

  5. #20
    Join Date
    Jan 2004
    Location
    n.h. usa
    Posts
    955
    here is my tivoapp patches for an original s3

    below is for 11.0b
    echo -ne "\x10\x00\x00\xaa" | dd conv=notrunc of=tivoapp bs=1 seek=1915420
    echo -ne "\x24\x10\x00\x01" | dd conv=notrunc of=tivoapp bs=1 seek=3619700
    echo -ne "\x00\x00\x80\x21" | dd conv=notrunc of=tivoapp bs=1 seek=2451664
    echo -ne "\x24\x11\x00\x00" | dd conv=notrunc of=tivoapp bs=1 seek=2451700
    echo -ne "\x00\x00\x80\x21" | dd conv=notrunc of=tivoapp bs=1 seek=14115792
    echo -ne "\x10\x40\x00\x26" | dd conv=notrunc of=tivoapp bs=1 seek=7934352

    first 2 are nocso and back door
    next 3 are cci
    last is 30 sec

  6. #21
    Join Date
    Jan 2004
    Location
    n.h. usa
    Posts
    955
    need these please for 11.0c thanks

  7. #22
    Join Date
    Jan 2005
    Posts
    1,008
    Quote Originally Posted by lgkahn View Post
    need these please for 11.0c thanks
    Here they are:
    Code:
    array set patch_11.0c {
    0x005d3a14 "104000aa 100000aa"
    0x00773b38 "00008021 24100001"
    0x00b92be4 "14400026 10400026"
    0x00656e40 "30b000ff 00008021"
    0x00656e64 "00e08821 24110000"
    0x0117e020 "30b000ff 00008021"
    }
    
    array set desc_11.0c {
    0x005d3a14 "noencrypt"
    0x00773b38 "backdoors"
    0x00b92be4 "30secskip"
    0x00656e40 "cci1"
    0x00656e64 "cci2"
    0x0117e020 "cci3"
    }
    Remember to subtract 0x400000 from the VMA address and then convert it to decimal to get your 'seek' value if you use the 'dd' method.

    The "tvapppatches-11.0c.tcl" was posted here.
    ScanMan --> Just another Tivo hacker...
    Killhdinitrd SA S2 Monte S2 Unscramble Upgrade Tivo Software

  8. #23
    Join Date
    Dec 2001
    Posts
    603
    Anyone have these for 11.0d?

  9. #24
    Join Date
    Jan 2005
    Posts
    1,008
    Quote Originally Posted by philhu View Post
    Anyone have these for 11.0d?
    It was posted here: http://www.dealdatabase.com/forum/sh...ad.php?t=61245
    ScanMan --> Just another Tivo hacker...
    Killhdinitrd SA S2 Monte S2 Unscramble Upgrade Tivo Software

  10. #25
    Join Date
    Jun 2006
    Location
    Dougal County
    Posts
    1,007
    Quote Originally Posted by ScanMan View Post
    in the 11.0d thread, no less...

    amazing...

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •