Page 1 of 14 12311 ... LastLast
Results 1 to 15 of 204

Thread: The Series4 (TiVo Premiere) Development Thread

  1. #1
    Join Date
    Jul 2005
    Posts
    574

    The Series4 (TiVo Premiere) Development Thread

    ===============
    General Information
    ===============

    So, the Series4 has been been announced, and it looks like it's got some new hardware under the hood. According to Dave Zatz, the platform is powered by the BCM7413 SoC. Like the chips used in the Series3 platform, this SoC probably has an integrated on-die PROM. In the Series3 platform, it wasn't used and TiVo continued to use their legacy external PROM system, thus allowing us to physically toy with with it and break the chain of trust. If TiVo finally moved the PROM on-die, I fear the hacking community very well may be dead for future platforms.

    If it's still stored on an external flash chip, we may still have a fighting chance.

    I will definitely be picking up a unit as soon as it hits the shelves, and if it has an external PROM, I'll post what info I can get. For now, I've started this thread to begin discussions.



    Anyone who wishes to donate money to go towards purchasing development hardware can do so here: DONATE


    If you wish to donate via Bitcoin, BTC donations may be sent to: 1NMneWDPS54qb6f5R2YGCVWUvfQg2nsG8Z

    If successful, anyone who donated money will be able to apply their donation towards a DIY PROM kit should they become possible.


    ===========
    News Updates
    ===========

    04/02/10: All major parts have been either ordered or received.

    03/25/10: tivo4mevo pointed to a great preliminary review that allows us all to take a peek at what's under the hood. Check it out here: http://mysite.verizon.net/~fiosdvr/prem_review_01.pdf

    03/30/10: Enough donations came in to cover the cost of some sockets and test chips, so they've been ordered. Still a bit away from the socket adapter needed for programming, but there are other things to look at while we're all waiting. :-)

    02/13/13: Focused development has resumed. Let's see if we can keep the momentum going. I should probably re-write this first post with the latest info at some point. :-)
    Last edited by Omikron; 02-13-2013 at 07:51 PM.
    .-=Omikron=-.

    TiVo Series4 Premiere Development HERE

    Do you have a PROM related question? Check HERE and HERE before sending me a PM. Any questions that have already been answered will be deleted if sent via PM.

  2. #2
    Join Date
    Jul 2005
    Posts
    574

    The TiVo Premiere Serial Interface

    The TiVo Premiere appears to use the same TTL serial interface as the Gen06 platform (TiVo HD). The unit uses 5V TTL logic to communicate via serial, and any adapters that work with the TiVo HD will also work with the Premiere.





    Without any modification to the bootpage, here is what factory TiVo Premiere displays upon power-on:

    Code:
    Shmoo Version=3.5                                                            
    DDR Freq=0x0000018C                                                         
    %00000001%                                                              
    RC1=00000003                                                           
    WC1=FFFFFFE2                                                        
    RC2=00000018
    WC2=0000002F
    RC3=0000000D
    WC3=FFFFFFE2
    RC4=0000000D
    WC4=0000002F
    NWC=00000008
    RC5=00000003
    WC5=00000008
    RC6=00000018
    WC6=00000008
    NRC=0000000D
    RW=00000016
    WW=0000004E
    G=00000000 R=0000000D W=00000008 
    BL=00000000
    RC1=00000000
    RC2=00000015
    
    BL=00000001
    RC1=00000003
    RC2=00000015
    
    BL=00000002
    RC1=00000002
    RC2=00000019
    
    BL=00000003
    RC1=00000003
    RC2=00000019
    
    BL=00000004
    RC1=00000001
    RC2=00000018
                                                                      
    BL=00000005
    RC1=00000004
    RC2=00000019
                                                                      
    BL=00000006
    RC1=00000002
    RC2=00000017
                                                                      
    BL=00000007
    RC1=00000002
    RC2=00000019
                                                                      
    TiVo Gen07 release 1.00 (2009-10-20 14:09:37)
    Copyright 2009 TiVo Inc.  All Rights Reserved.
    TSN: REDACTED  BREV: 0x1060  MAC: RE:DA:CT:ED
    Thumbprint: 356515097AED79CCEC5097DA723F8FE654826A83
    Disk: WDC WD3200AVVS-63L2B0  F/W: 01.03A01  S/N: WD-REDACTED 
    Booting from partition 3... 3800064 bytes
    Kernel signed by '... the Porridge bird ...'
    Hashing kernel (SHA256)... done
    Checking signature... done.
    Signed, valid for release
    Kernel entry point is 0x802b8000
                                                  
    cfeBootParms ===> root=/dev/sda4
    Kernel boot options: root=/dev/sda4 console=ttyS0,115200 boardID=0x106001 HpkImp
    Gen07
                                                                            
    BOOTEDFROMFLASH, Base=1c000000
    Initial CP0 22 value : 0xe30f3406
    node [00000000, 10000000: RAM]
    node [20000000, 10000000: RAM]
    mips_counter_frequency = 202000000 from Calibration, = 202500000 from header(CPU_MHz/2)
    Access to the PROM Boot Menu is no longer restricted by a factory password unique to the unit. Sending ^C to down the line during the first few seconds will display the PROM boot menu.

    Currently Known Commands:
    Code:
    boot [-3,-6]
    disk
    reset
    Kernel message logging via serial can be enabled by connecting the disk to PC and using the bootpage.x86 binary to add "dsscon=true console=0,115200" flags to the bootpage parameters.

    Since my USB-SATA adapter was located at /dev/sdb, and the TiVo's bootpage was currently set to "root=/dev/sda4" I issued the following command:
    Code:
    bootpage.x86 -P "root=/dev/sda4 dsscon=true console=0,115200" -C /dev/sdb
    Attached Files Attached Files
    Last edited by Omikron; 04-04-2010 at 03:39 PM. Reason: Added Serial Console Info
    .-=Omikron=-.

    TiVo Series4 Premiere Development HERE

    Do you have a PROM related question? Check HERE and HERE before sending me a PM. Any questions that have already been answered will be deleted if sent via PM.

  3. #3
    Join Date
    Jul 2005
    Posts
    574

    The TiVo Premiere PROM

    So far, here's what we know about the TiVo Premiere's PROM:



    TiVo has finally broken free of the previous design. For the first time since the debut of the Series2 platform, TiVo has selected a new type of flash chip to store the the boot PROM. The flash package is TSOP56, which is kind of a pain in the ass to work with for a variety of reasons. Primarily, they're hard to solder and the socket adapters needed to work with them can be quite expensive.

    Preliminary review of the datasheet seems to indicate that all of the security features of this flash device seem to relate to write protection, and not read protection, so in theory we should be able to program fresh chips with modified code.

    We won't know a whole lot more until I can get my hands on a TiVo Premiere and a TSOP56 socket adapter for my programmer. Since we'll need a new set of hardware to work with the new platform, I've gone ahead and put up a donation link in the first post of this thread along with a list of what we think we need so far.
    Last edited by Omikron; 03-26-2010 at 02:22 AM.
    .-=Omikron=-.

    TiVo Series4 Premiere Development HERE

    Do you have a PROM related question? Check HERE and HERE before sending me a PM. Any questions that have already been answered will be deleted if sent via PM.

  4. #4
    Join Date
    Jul 2005
    Posts
    574
    Reserved for future info on possible changes in kernel.
    .-=Omikron=-.

    TiVo Series4 Premiere Development HERE

    Do you have a PROM related question? Check HERE and HERE before sending me a PM. Any questions that have already been answered will be deleted if sent via PM.

  5. #5
    Join Date
    Oct 2004
    Posts
    307
    Once things settle down a little bit, and if it looks like its even faintly possible, I'll be sending you a check for the purchase price of the cheaper of the two models. My contribution to the cause.

    EDITED TO ADD: Street price BTW; I'm no fracking Ford Foundation
    Last edited by Roger Dylan; 03-03-2010 at 06:21 AM.

  6. #6
    Join Date
    Jul 2005
    Posts
    574
    Quote Originally Posted by Roger Dylan View Post
    Once things settle down a little bit, and if it looks like its even faintly possible, I'll be sending you a check for the purchase price of the cheaper of the two models. My contribution to the cause.

    EDITED TO ADD: Street price BTW; I'm no fracking Ford Foundation
    Street price as opposed to... :-)
    .-=Omikron=-.

    TiVo Series4 Premiere Development HERE

    Do you have a PROM related question? Check HERE and HERE before sending me a PM. Any questions that have already been answered will be deleted if sent via PM.

  7. #7
    Join Date
    Jul 2005
    Posts
    574
    Well, I've got the TiVo Premiere pre-ordered, so let's see how this dance goes...
    .-=Omikron=-.

    TiVo Series4 Premiere Development HERE

    Do you have a PROM related question? Check HERE and HERE before sending me a PM. Any questions that have already been answered will be deleted if sent via PM.

  8. #8
    Join Date
    Jul 2005
    Posts
    574
    Is there any chance someone got their hands on an early unit? Many Best Buys received their shipments early last week, and a few stores accidentally sold a few before the price in the system was modified to $2,000 to prevent sales staff from overriding the hard street date of 03/28.

    If anyone has an early unit, photos of the motherboard would be greatly appreciated.
    .-=Omikron=-.

    TiVo Series4 Premiere Development HERE

    Do you have a PROM related question? Check HERE and HERE before sending me a PM. Any questions that have already been answered will be deleted if sent via PM.

  9. #9
    Join Date
    Jul 2005
    Posts
    574
    New link with delicious info: http://mysite.verizon.net/~fiosdvr/prem_review_01.pdf

    Link courtesy of tivo4mevo. Info couresty of bkdtv.
    .-=Omikron=-.

    TiVo Series4 Premiere Development HERE

    Do you have a PROM related question? Check HERE and HERE before sending me a PM. Any questions that have already been answered will be deleted if sent via PM.

  10. #10
    Join Date
    Jul 2005
    Posts
    574
    Updated some info regarding the PROM and the possible serial interface.

    PROM has changed drastically and has some new "security" features which I'm still investigating. Serial appears to be the same as THD, at least from visual observation.
    .-=Omikron=-.

    TiVo Series4 Premiere Development HERE

    Do you have a PROM related question? Check HERE and HERE before sending me a PM. Any questions that have already been answered will be deleted if sent via PM.

  11. #11
    Join Date
    Jul 2005
    Posts
    574
    After researching a few different test socket vendors, it seems that Meritec seems to make something that would be of great use to those of us who will be busy trying to work on the PROM:



    http://meritec.thomasnet.com/item/sm...56-01?&seo=110
    .-=Omikron=-.

    TiVo Series4 Premiere Development HERE

    Do you have a PROM related question? Check HERE and HERE before sending me a PM. Any questions that have already been answered will be deleted if sent via PM.

  12. #12
    Join Date
    Jan 2002
    Location
    Sonoran Desert
    Posts
    2,829
    Quote Originally Posted by Omikron View Post
    TiVo has finally broken free of the previous design. For the first time since the debut of the Series2 platform, TiVo has selected a new type of flash chip to store the the boot PROM. The flash package is TSOP56, which is kind of a pain in the ass to work with for a variety of reasons. Primarily, they're hard to solder and the socket adapters needed to work with them can be quite expensive.
    I figured they'd be easier to remove since TSOPs only have two sides instead of four. Just melt one side, lift it about a millimeter, then repeat on the other side and its off. At least, I would think it would be easier to remove and socket with less risk of lifting any pads.
    Before PMing me: Iím not your personal tech support. If you have a question, ask in public so I don't have to repeat if somebody else asks. If you want images or slices, use emule. I will ignore all support PMs.

    Sponsor a vegetarian! I have taken the pledge, how about you?

  13. #13
    Join Date
    Jul 2005
    Posts
    574
    Quote Originally Posted by AlphaWolf View Post
    I figured they'd be easier to remove since TSOPs only have two sides instead of four. Just melt one side, lift it about a millimeter, then repeat on the other side and its off. At least, I would think it would be easier to remove and socket with less risk of lifting any pads.
    I guess it depends on how much you're concerned about damaging the original chip. The leads are certainly far more fragile and it's very easy to get them bent out of shape if you're not careful. Soldering a TSOP directly to the board shouldn't too bad, although soldering the socket is some what of a pain in the ass, more so than the PLCC32 sockets.

    Realistically, I'm not sure most users would actually need to socket it. Historically we've never had to replace the PROM once it was installed and now we have an even bigger reason to skip the socket altogether. For initial PROM hacking though, it's clearly needed. :-)
    .-=Omikron=-.

    TiVo Series4 Premiere Development HERE

    Do you have a PROM related question? Check HERE and HERE before sending me a PM. Any questions that have already been answered will be deleted if sent via PM.

  14. #14
    Join Date
    Aug 2004
    Posts
    4,086
    Another question worth exploring is whether the PROM can be reprogrammed in-place. This assumes, of course, that a root shell can be obtained by a purely software means first.

  15. #15
    Join Date
    Nov 2004
    Posts
    418
    Based upon the OTP bits described in the Flash data sheet, the boot code is likely locked.

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •