Page 12 of 15 FirstFirst ... 21011121314 ... LastLast
Results 166 to 180 of 211

Thread: The Series4 (TiVo Premiere) Development Thread

  1. #166
    Join Date
    Dec 2003
    Posts
    233
    The key is to robustly identify (if possible) the handover point from signals that come purely from the SATA bus. Perhaps a box like this might do the trick:

    http://teledynelecroy.com/protocolan...id=103&mid=511

    If it is possible, then figure out how to program an FPGA to look for the handover point and drive a SATA hardware switch to select between the real hard drive and a small FLASH SATA drive that contains the modified kernel. The modified kernel would know to issue a special ATA command to switch back to the disk drive that the FPGA would also look for.

  2. #167
    Join Date
    May 2003
    Posts
    201
    Quote Originally Posted by tivo4mevo View Post

    In the absence of such a wiki (and to make good on my suggestion to pose your question), here's a rough run-down of the boot process any some history of some of the exploits from the past decade:

    Awesome post. It brings me up to speed on this topic after being away for years.

    Quote Originally Posted by tivo4mevo View Post
    The board facilitates discussion, but is not as good a repository.
    In the absence of of a wiki, this information is sticky worthy if it gets future updates. Searching is really problematic as you often find an old post that has outdated and currently untrue information. It takes eons to determine the actual current state of affairs.

    An unrelated topic, but case in point, I have been searching for hours to determine if a series 3 can do a 2tb+2tb drive setup and no definitive answer yet. Most searches say 1TB is the biggest you can do but weaknees sells a 2TB internal. This is merely empirically showing how the forum is a poor repository.

    Although certainly more difficult, the SATA injection device seems the most interesting. It seems that once engineered that it would become difficult to implement additional security steps to defeat it, although certainly new models would require a modified device. This also has the added benefit of potentially pulling in more developers who are currently unwilling to take a soldering iron to their tivo.

    My .02

  3. #168
    Join Date
    Dec 2003
    Posts
    233
    Wouldn't you know it. I posted a link and all of the TiVo hacker nuts looking at it crashed it.

  4. #169
    Join Date
    Jul 2005
    Posts
    347
    Quote Originally Posted by jonbig View Post
    Wouldn't you know it. I posted a link and all of the TiVo hacker nuts looking at it crashed it.
    Google Cache still works. ;-)
    .-=Omikron=-.

    TiVo Series4 Premiere Development HERE

    Do you have a PROM related question? Check HERE and HERE before sending me a PM. Any questions that have already been answered will be deleted if sent via PM.

  5. #170
    Join Date
    Jul 2005
    Posts
    347
    I'm *still* looking for high resolution photos of a quad tuner TiVo such as the Premiere 4, previously known as the Premiere Elite.

    If one of you folk have these, please stop for a moment and post some complete photos of the various parts of the board.

    Edit: This is the kind of thing that allows research efforts like this to stagnate. If you are interested in seeing this work, don't just lurk. Participate. If you don't have the time, donate. :-)
    Last edited by Omikron; 02-13-2013 at 07:46 PM.
    .-=Omikron=-.

    TiVo Series4 Premiere Development HERE

    Do you have a PROM related question? Check HERE and HERE before sending me a PM. Any questions that have already been answered will be deleted if sent via PM.

  6. #171
    Join Date
    Jul 2005
    Posts
    347

    That poor CPU...ifi

    In case anyone was curious, we've now sacrificed a number of Premiere's while trying to extract hardware components for analysis.

    This beaten and battered CPU is from number three:

    IMG_0616.jpg

    The battle scars you see were not inflicted by me, but by other research partners who have been trying to figure out a away to separate the die from the carrier. The acids we're using get very useless very quickly with all of that crap around it.
    .-=Omikron=-.

    TiVo Series4 Premiere Development HERE

    Do you have a PROM related question? Check HERE and HERE before sending me a PM. Any questions that have already been answered will be deleted if sent via PM.

  7. #172
    Join Date
    Jul 2005
    Posts
    347
    So here I am looking for extra chips to decap and I come along this: http://parts.americaii.com/PartDetai...CM7413ZKFEB01G

    According to their very professional and trustworthy website, they have they carry the highest quality BCM7413ZKFEB01G available!

    Oh man, I am so sick of these part search engines...
    .-=Omikron=-.

    TiVo Series4 Premiere Development HERE

    Do you have a PROM related question? Check HERE and HERE before sending me a PM. Any questions that have already been answered will be deleted if sent via PM.

  8. #173
    Join Date
    Dec 2003
    Posts
    233
    What would really be golden is if someone made a SATA to ATA over Ethernet adapter. With that and a bit of hacking on the linux aoe target software and you'd have a solution using the "read twice" hack approach. Unfortunately, it appears no one makes such a useful bit of hardware. Everything I've found only adapts in the other direction. What? Nobody wants to attach legacy clients to an AoE SAN?

  9. #174
    Join Date
    Jul 2005
    Posts
    347
    Quote Originally Posted by jonbig View Post
    What would really be golden is if someone made a SATA to ATA over Ethernet adapter. With that and a bit of hacking on the linux aoe target software and you'd have a solution using the "read twice" hack approach. Unfortunately, it appears no one makes such a useful bit of hardware. Everything I've found only adapts in the other direction. What? Nobody wants to attach legacy clients to an AoE SAN?
    Your post made me smile because I went through the same thought process last week and probably performed the same searches you did just now. :-)
    .-=Omikron=-.

    TiVo Series4 Premiere Development HERE

    Do you have a PROM related question? Check HERE and HERE before sending me a PM. Any questions that have already been answered will be deleted if sent via PM.

  10. #175
    Join Date
    Jan 2002
    Location
    Sonoran Desert
    Posts
    2,829
    oops duplicate
    Last edited by AlphaWolf; 02-14-2013 at 05:58 AM. Reason: duplicate
    Before PMing me: Iím not your personal tech support. If you have a question, ask in public so I don't have to repeat if somebody else asks. If you want images or slices, use emule. I will ignore all support PMs.

    Sponsor a vegetarian! I have taken the pledge, how about you?

  11. #176
    Join Date
    Jan 2002
    Location
    Sonoran Desert
    Posts
    2,829
    Hmm...so people are entertaining my disk spoofing idea from several years back it seems

    Quote Originally Posted by jonbig View Post
    What would really be golden is if someone made a SATA to ATA over Ethernet adapter. With that and a bit of hacking on the linux aoe target software and you'd have a solution using the "read twice" hack approach. Unfortunately, it appears no one makes such a useful bit of hardware. Everything I've found only adapts in the other direction. What? Nobody wants to attach legacy clients to an AoE SAN?
    I've been doing datacenter work recently and I've liked the idea of that. I just built a 4x3TB RAID-Z array using seagate st3000dm001 disks (I know, seagate - EVIL! but hey they were relatively cheap, thanks to best buy's generosity.) and even on a weaker i3 3220 CPU it performs quite well with sequential reads hitting speeds slightly better than my SSD's.

    I've largely done away with my tivos though (because of CCI crippling my hdhomerun, I have mostly moved to sickbeard and couchpotato, both of which work so well that I have moved my tivo's into the smaller bedrooms, with one of them no longer in use) but I do enjoy looking on the progress of my past exploits now and then.

    Brushing that aside though, I am curious how practical it would be for the hard disk itself to handle all of this. From what I understand, newer disks basically have their own operating system which already does geometric remapping to fit the expected logical layout of the host controller, which is done to compensate for imperfections in the manufacturing process.

    What would stop one from hijacking this process in other than intended ways? Not really a problem if the processor (cpu? fpga? asic?) is too slow as the disk can just delay the boot stage a bit if necessary. If it is physically possible, the nasty part is figuring out how to program the damn thing. If the disk's logic board is capable as is, you're looking at zero cost in modding and effectively a new software exploit that would be somewhat difficult for tivo to countermeasure in a cost effective manner (without say, moving *all* executable code on to a large embedded flash disk, or perhaps encrypting the entire disk using assymetric cryptography, which I'm not sure any hard disk OEM's provide the capability of.)

    If not, then perhaps a less costly modification to the logic board would be in order (and not to mention less risky than doing BGA rework.)

    EDIT: Wow, my signature still mentions emule...how retro.
    Last edited by AlphaWolf; 02-14-2013 at 05:56 AM.
    Before PMing me: Iím not your personal tech support. If you have a question, ask in public so I don't have to repeat if somebody else asks. If you want images or slices, use emule. I will ignore all support PMs.

    Sponsor a vegetarian! I have taken the pledge, how about you?

  12. #177
    Join Date
    Aug 2010
    Posts
    17
    Quote Originally Posted by Omikron View Post
    I'm *still* looking for high resolution photos of a quad tuner TiVo such as the Premiere 4, previously known as the Premiere Elite.

    If one of you folk have these, please stop for a moment and post some complete photos of the various parts of the board.

    Edit: This is the kind of thing that allows research efforts like this to stagnate. If you are interested in seeing this work, don't just lurk. Participate. If you don't have the time, donate. :-)
    I'd be curious to see some high resolution pics for any of the premieres. With and without chips removed, or one's that have traces annotated.

  13. #178
    Join Date
    Nov 2004
    Posts
    420
    Quote Originally Posted by Zirak View Post
    In the absence of of a wiki, this information is sticky worthy if it gets future updates. Searching is really problematic as you often find an old post that has outdated and currently untrue information. It takes eons to determine the actual current state of affairs.
    Yes, that's a hazard of the message board versus wiki, you find yourself poring over conversations germane only to exploiting software 4.0.1b with an lba48 aware kernel and the proper uma6fix to work on a DirecTV combo box... While interesting from an archeological point of view, not ideal for getting ones feet wet. To be honest, I think that the community shrank considerably once the software-only exploits dried up and tivo had engineered most of the features that were previously only available via hacks (internal web server, network remote, show extraction, etc.). The main reasons I see folks stopping by these days is to transfer or extract CCI protected shows, and tivo's MRS' allowed streaming.

    An unrelated topic, but case in point, I have been searching for hours to determine if a series 3 can do a 2tb+2tb drive setup and no definitive answer yet. Most searches say 1TB is the biggest you can do but weaknees sells a 2TB internal. This is merely empirically showing how the forum is a poor repository.
    Agreed again. There used to be "state of the art" posts that would get written every year or so, but there are fewer people to write those these days, it seems.

  14. #179
    Join Date
    Nov 2004
    Posts
    420
    Quote Originally Posted by GaveUp View Post
    I'd be curious to see some high resolution pics for any of the premieres. With and without chips removed, or one's that have traces annotated.
    You've seen bkdtv's review, I presume? It provides a nice hardware baseline, so it's a starting point. Link: here.

  15. #180
    Join Date
    Aug 2010
    Posts
    17
    Quote Originally Posted by tivo4mevo View Post
    You've seen bkdtv's review, I presume? It provides a nice hardware baseline, so it's a starting point. Link: here.
    Nope I hadn't seen that one but looks like a decent starting point. Thanks.

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •