The Series4 (TiVo Premiere) Development Thread

**Omikron** · 03-26-2010, 10:37 PM

Originally Posted by tivo4mevo

Based upon the OTP bits described in the Flash data sheet, the boot code is likely locked.

I was thinking the same thing, but we can use this to our (small) advantage. Whereas before there was some question as to whether or not TiVo was capable of remote-flashing the PROM, setting the OTP bits in the flash in new PROM chips could guarantee that the modified code isn't over written by any future updates.

**AlphaWolf** · 03-27-2010, 07:51 AM

I notice there are several unused footprints on the motherboard, one resembling a jtag header. I don't suppose anybody would have the technical skill necessary to work out a solution similar to game console mod chips? E.g. no tsop removal necessary, just solder in a daughterboard that circumvents the tsop substituting its own boot code.

**Omikron** · 03-27-2010, 01:25 PM

Originally Posted by AlphaWolf

I notice there are several unused footprints on the motherboard, one resembling a jtag header. I don't suppose anybody would have the technical skill necessary to work out a solution similar to game console mod chips? E.g. no tsop removal necessary, just solder in a daughterboard that circumvents the tsop substituting its own boot code.

Something like this may indeed be possible, but the initial design would very likely take a great deal of work and significant skill. In matters of console modchips, the sheer amount of work needed to pull something like that off is offset by the gobs of money modchip makers make.

In a small community driven environment like this where only a very few handful of people are interested, it's much harder to find someone who's willing to put forth the resources to develop and maintain it. I know a few people that would probably be able to pull something like that off, but not without throwing piles of cash at them.

**mike_s** · 03-27-2010, 02:04 PM

Originally Posted by AlphaWolf

I notice there are several unused footprints on the motherboard, one resembling a jtag header. I don't suppose anybody would have the technical skill necessary to work out a solution similar to game console mod chips? E.g. no tsop removal necessary, just solder in a daughterboard that circumvents the tsop substituting its own boot code.

Completely different things.

I can speak for how it works on a Wii - what keeps a homemade disc from containing non-approved content is some info stored in a way it can't be written with a CD-R writer. The chips work by injecting code into the Wii's CD controller, and that code always tells the Wii itself that the disc is approved. It takes advantage of a diagnostic capability of the CD chip, and the code gets stored in the RAM of that chip. They are NOT overriding any flash/(EP)ROMs, etc.

You can't override a ROM using JTAG (at least not in real-time, which is what's needed here). It just doesn't work that way. You might, however, be able to re-program the flash ROM using JTAG

**Omikron** · 03-27-2010, 03:28 PM

We should keep in mind that the PROM on this platform does have OTP bits that can be set, blocking further write access to the chip. If such bits have been set, then creating any type of add-on adapter is going to be much, much more difficult.

**Omikron** · 03-28-2010, 09:00 PM

Well, I decided to cancel my pre-order and just pick one up from Best Buy today. So, I now have a Premiere in-hand but alas no other hardware to interface with the PROM yet.

I'll try to tinker around with other things in the mean time. :-)

**jt1134** · 03-28-2010, 09:10 PM

Originally Posted by Omikron

Well, I decided to cancel my pre-order and just pick one up from Best Buy today. So, I now have a Premiere in-hand but alas no other hardware to interface with the PROM yet.

I'll try to tinker around with other things in the mean time. :-)

Code:

for x in 3 4 6 7 9
do
dd if=/dev/hda$x | gzip -9n > hda$x.gz
done

**Omikron** · 03-28-2010, 09:52 PM

In other news, in my INFINITE WISDOM I sold my own TTL adapter a while ago to someone who really wanted one, thinking that I would simply replace it later. It seems that I forgot to replace it... :-/

::grumble::

Time to buy a new adapter.

**AlphaWolf** · 03-29-2010, 12:57 AM

Originally Posted by mike_s

Completely different things.

I can speak for how it works on a Wii - what keeps a homemade disc from containing non-approved content is some info stored in a way it can't be written with a CD-R writer. The chips work by injecting code into the Wii's CD controller, and that code always tells the Wii itself that the disc is approved. It takes advantage of a diagnostic capability of the CD chip, and the code gets stored in the RAM of that chip. They are NOT overriding any flash/(EP)ROMs, etc.

You can't override a ROM using JTAG (at least not in real-time, which is what's needed here). It just doesn't work that way. You might, however, be able to re-program the flash ROM using JTAG

I was thinking more along the lines of the original xbox. That was simply a matter of breaking the chain of trust, just like a tivo. Mod chips for that would simply plug in to the jtag footprint and a single via hole which made the xbox basically ignore the onboard tsop and boot from a tsop contained in the daughterboard instead.

Or if you wanted to you could just replace the tsop with a reprogrammed one entirely, and some people did it this way. This is the same thing we do with tivos right now.

I imagine you can't do a similar thing for the wii due to the boot code being contained read only in some sort of asic that also handles much if not all of the central processing. I wouldn't know though as I've never owned one. Tivo's certainly don't operate in this manner though.

**Omikron** · 03-29-2010, 11:41 PM

Alright, I decided to completely strip down my Series4 to the bare board and take some photos for your voyeuristic pleasure.

Top:

Here's a pretty good view of the whole board, very much like the images bkdtv posted.

Bottom:

An overall view of the bottom of the board. There is something neat going on here with the two grey thermal interface pads underneath the tuners. It would seem that the tuners put out enough heat that they felt the need to sink the heat directly into the chassis. There are two metal indents in the chassis underneath this area that interfaces directly with these pads.

Top Left Closeup:

In this view we can see the battery, the TSOP56 PROM, and an empty location next to it that looks like a TSOP48 chip of some sort. I'm not really sure why there's a second spot here. It's possible that TiVo wasn't sure if it was going to use a TSOP56 flash or a TSOP48 flash, but it doesn't make sense that they would leave it there. The PROM flash chip, like the platforms before it, has a silk-screened area for where the socket would align around it. Also of note is the SW1 switch that seems to be missing from the board in the top left area. It's possible that this switch would be used during development to perform some sort of reset function, so it will be interesting to see what it does.

Top Right Closeup:

Nothing too interesting here it seems. More scattered unpopulated debug headers.

Bottom Right Closeup:

In the center of this image we can see the 4 pin TTL serial header which the TiVo HD used. Of note is the large area in the tuners that seems to be completely unpopulated. I do wonder what it could have held, and perhaps more poking and prodding will tell us. There is also a mysterious 5 pin header in the upper left area here that leads directly to the CPU. The header is surrounded by a grounding pin on each side, and I haven't been able to determine what type of connector would fit in there. Any ideas here would be welcome.

Bottom Left Closeup:

There are some really interesting things going on here. We can see lots of unpopulated areas here for both pin headers and capacitors, neither of which would allow the CableCard slot to be there had they been populated. This would seem to imply that the development versions of this board did not even have a CableCard slot, and perhaps interfaced to a "CableCARD Test Device" of some sort. Note that one of the pin headers leading directly to the CPU has a pin count of 14, which would indicate that it may in fact be a JTAG header. I will see if I can investigate this further over the coming weeks. I will probably have to make a ribbon cable that I can solder to the bottom of the board, and bring up the pins to the top in a way that wouldn't interfere with the CableCARD.

**Omikron** · 03-31-2010, 12:17 AM

03/30: Enough donations came in to cover the cost of some sockets and test chips. Still a bit away from the socket adapter needed for programming, but there are other things to look at while we're all waiting. :-)

**AlphaWolf** · 03-31-2010, 03:48 PM

Originally Posted by Omikron

In this view we can see the battery, the TSOP56 PROM, and an empty location next to it that looks like a TSOP48 chip of some sort. I'm not really sure why there's a second spot here. It's possible that TiVo wasn't sure if it was going to use a TSOP56 flash or a TSOP48 flash, but it doesn't make sense that they would leave it there.

I was thinking about that myself, hell they even pre-soldered the pads. I'm wondering if there may be some way of making the tivo ignore the 56 and use the 48 instead if you simply put one on there. If so you could potentially hack the tivo using nothing more than bit of heat.

**Omikron** · 03-31-2010, 06:44 PM

Originally Posted by AlphaWolf

I was thinking about that myself, hell they even pre-soldered the pads. I'm wondering if there may be some way of making the tivo ignore the 56 and use the 48 instead if you simply put one on there. If so you could potentially hack the tivo using nothing more than bit of heat.

While it would be marginally easier to simply add a new flash and cut some traces to disable the old one, I'm not sure the trade-off is worth it.

Advantages:

+ Doesn't require the hot-air rework or ChipQuik to remove old TSOP package.

Disadvantages:

- Requires physically damaging traces on the motherboard in order to work (assuming you're still trying to take advantage of not having to desolder the old chip).
- Programming requires an overpriced TSOP48 programming adapter.
- It may be difficult to find a TSOP48 packages that matches the same design characteristics of the StrataFlash chip from Intel.

Considering I still don't even have the TSOP56 adapter needed to read the chip, let alone write new ones, it doesn't feel like such a hack would be a high priority.

That said, the idea is still neat, and I admit that I'm a bit curious if it were be possible even if there were no "good" reasons for doing it. :-)

**Omikron** · 03-31-2010, 09:47 PM

I finally got around to connecting the Series4 drive to my PC to grab some of the partitions off of it.

The good news is that I now have gzip'd copies of partitions 1-9. The bad news is that somehow int the process I managed to make the drive unbootable. The TiVo now gets stuck at a "Almost there..." screen, so I'll have to pull it again and see if there's any useful info in the logs.

Either way, here's the initial PROM boot log from the messages log:

Code:

Mar 31 20:52:52 (none) syslogd 1.5.0: restart.
Mar 31 20:53:25 (none) Stats: == System startup resource statistics ==
Mar 31 20:53:25 (none) Stats: ++ System build version numbers ++
Mar 31 20:53:25 (none) Stats: b-14-1-mr @384589 2010.03.19-1443 release-mips_k26 [] ARM_IDL_FREEZE CDDB_QUERY DCT_SERIAL DSS_SERIAL HPK IDL_FREEZE IRBLAST LOCAL_CALYPSO_SERVER LOCAL_MP3_PLAYER LOCAL_MUSIC_PLAYER LOCAL_PHOTO_VIEWER LOCAL_WMA_PLAYER MACROVISION MULTI_ROOM_VIEWING PERF_LOGGER PERF_LOGGER_USER_STATS PTHREADS_TMK REQUIRE_PRODUCTION_SPIGOT_LINEAGE SANITIZE_LOGS STRONG_CRYPTO T2KSOURCE US_CABLE_AUTO_DETECT WMDRMPD 
Mar 31 20:53:25 (none) Stats: 2010.03.19-1443 14.1-01-3 
Mar 31 20:53:25 (none) Stats: PROM version: Gen07 release 1.00 (2009-10-20 14:09:37)
Mar 31 20:53:25 (none) Stats: Version : Gen07 release 1.00 (2009-10-20 14:09:37) SHA : 356515097AED79CCEC5097DA723F8FE654826A83 
Mar 31 20:53:25 (none) Stats: System Serial Number: 746XXXXXXXXXX
Mar 31 20:53:25 (none) Stats: Linux version 2.6.18-5.1 (build@buildmaster74) (gcc version 3.3.4) #1 Mon Mar 15 10:01:56 PDT 2010 
Mar 31 20:53:25 (none) Stats: ++ Memory usage ++
Mar 31 20:53:25 (none) Stats: MemTotal:       329200 kB 
Mar 31 20:53:25 (none) Stats: MemFree:        256240 kB 
Mar 31 20:53:25 (none) Stats: Buffers:          1456 kB 
Mar 31 20:53:25 (none) Stats: Cached:          49300 kB 
Mar 31 20:53:25 (none) Stats: SwapCached:          0 kB 
Mar 31 20:53:25 (none) Stats: Active:          18500 kB 
Mar 31 20:53:25 (none) Stats: Inactive:        36876 kB 
Mar 31 20:53:25 (none) Stats: HighTotal:           0 kB 
Mar 31 20:53:25 (none) Stats: HighFree:            0 kB 
Mar 31 20:53:25 (none) Stats: LowTotal:       329200 kB 
Mar 31 20:53:25 (none) Stats: LowFree:        256240 kB 
Mar 31 20:53:25 (none) Stats: SwapTotal:      131064 kB 
Mar 31 20:53:25 (none) Stats: SwapFree:       131064 kB 
Mar 31 20:53:25 (none) Stats: Dirty:              88 kB 
Mar 31 20:53:25 (none) Stats: Writeback:           0 kB 
Mar 31 20:53:25 (none) Stats: AnonPages:        4656 kB 
Mar 31 20:53:25 (none) Stats: Mapped:           9384 kB 
Mar 31 20:53:25 (none) Stats: Slab:            11936 kB 
Mar 31 20:53:25 (none) Stats: PageTables:        864 kB 
Mar 31 20:53:25 (none) Stats: NFS_Unstable:        0 kB 
Mar 31 20:53:25 (none) Stats: Bounce:              0 kB 
Mar 31 20:53:25 (none) Stats: CommitLimit:    295664 kB 
Mar 31 20:53:25 (none) Stats: Committed_AS:    33216 kB 
Mar 31 20:53:25 (none) Stats: VmallocTotal:  1048524 kB 
Mar 31 20:53:25 (none) Stats: VmallocUsed:      3536 kB 
Mar 31 20:53:25 (none) Stats: VmallocChunk:  1041352 kB 
Mar 31 20:53:25 (none) Stats: ++ CPU info ++
Mar 31 20:53:25 (none) Stats: system type^I^I: BCM97xxx Settop Platform 
Mar 31 20:53:25 (none) Stats: build target^I^I: unknown 
Mar 31 20:53:25 (none) Stats: processor^I^I: 0 
Mar 31 20:53:25 (none) Stats: cpu model^I^I: BMIPS4380 V4.4  FPU V0.1 
Mar 31 20:53:25 (none) Stats: cpu MHz^I^I^I: 402.43 
Mar 31 20:53:25 (none) Stats: BogoMIPS^I^I: 402.43    ( udelay_val : 201216  HZ = 1000 ) 
Mar 31 20:53:25 (none) Stats: wait instruction^I: yes 
Mar 31 20:53:25 (none) Stats: microsecond timers^I: yes 
Mar 31 20:53:25 (none) Stats: tlb_entries^I^I: 32 
Mar 31 20:53:25 (none) Stats: extra interrupt vector^I: yes 
Mar 31 20:53:25 (none) Stats: hardware watchpoint^I: no 
Mar 31 20:53:25 (none) Stats: ASEs implemented^I: mips16 
Mar 31 20:53:25 (none) Stats: VCED exceptions^I^I: not available 
Mar 31 20:53:25 (none) Stats: VCEI exceptions^I^I: not available 
Mar 31 20:53:25 (none) Stats: RAC setting^I^I: Unknown 
Mar 31 20:53:25 (none) Stats: unaligned access^I: 0 
Mar 31 20:53:25 (none) Stats: rdhwr/brdhwr traps^I: 0 / 0 
Mar 31 20:53:25 (none) Stats: cycle counter frequency^I: 27046875 
Mar 31 20:53:25 (none) Stats: ++ Module info ++
Mar 31 20:53:26 (none) Stats: router 68608 0 - Live 0xc005d000 
Mar 31 20:53:26 (none) Stats: ubuddy 7808 0 - Live 0xc0017000 
Mar 31 20:53:26 (none) Stats: pod 15680 2 - Live 0xc003a000 
Mar 31 20:53:26 (none) Stats: tv_bcm7405 37056 0 - Live 0xc0052000 
Mar 31 20:53:26 (none) Stats: bcm7405 2986848 65 tv_bcm7405, Live 0xc0426000 
Mar 31 20:53:26 (none) Stats: tr 4736 2 - Live 0xc002a000 
Mar 31 20:53:26 (none) Stats: nxp7164 47840 12 - Live 0xc0045000 
Mar 31 20:53:26 (none) Stats: drx 234640 22 - Live 0xc0080000 
Mar 31 20:53:26 (none) Stats: ircatch 9344 0 - Live 0xc002f000 
Mar 31 20:53:26 (none) Stats: frontpanel 2752 1 ircatch, Live 0xc001a000 
Mar 31 20:53:26 (none) Stats: i2c 9024 2 ubuddy,drx, Live 0xc0026000 
Mar 31 20:53:26 (none) Stats: softi2c 9088 1 bcm7405, Live 0xc0022000 
Mar 31 20:53:26 (none) Stats: gpio 10688 5 pod,drx,softi2c, Live 0xc001e000 
Mar 31 20:53:26 (none) Stats: ++ Device info ++
Mar 31 20:53:26 (none) Stats: Character devices: 
Mar 31 20:53:26 (none) Stats:   1 mem 
Mar 31 20:53:26 (none) Stats:   2 pty 
Mar 31 20:53:26 (none) Stats:   3 ttyp 
Mar 31 20:53:26 (none) Stats:   4 ttyS 
Mar 31 20:53:26 (none) Stats:   5 /dev/tty 
Mar 31 20:53:26 (none) Stats:   5 /dev/console 
Mar 31 20:53:26 (none) Stats:   5 /dev/ptmx 
Mar 31 20:53:26 (none) Stats:  10 misc 
Mar 31 20:53:26 (none) Stats:  21 sg 
Mar 31 20:53:26 (none) Stats:  30 tvbcmdriver 
Mar 31 20:53:26 (none) Stats:  33 nexus 
Mar 31 20:53:26 (none) Stats:  97 ubuddy 
Mar 31 20:53:26 (none) Stats:  99 i2c 
Mar 31 20:53:26 (none) Stats: 104 router 
Mar 31 20:53:26 (none) Stats: 108 ppp 
Mar 31 20:53:26 (none) Stats: 111 pod 
Mar 31 20:53:26 (none) Stats: 112 drx 
Mar 31 20:53:26 (none) Stats: 114 tr 
Mar 31 20:53:26 (none) Stats: 121 saa7164 
Mar 31 20:53:26 (none) Stats: 127 ircatch 
Mar 31 20:53:26 (none) Stats: 128 ptm 
Mar 31 20:53:26 (none) Stats: 136 pts 
Mar 31 20:53:26 (none) Stats: 180 usb 
Mar 31 20:53:26 (none) Stats: 189 usb_device 
Mar 31 20:53:26 (none) Stats: 243 gioctl 
Mar 31 20:53:26 (none) Stats: 246 gpio 
Mar 31 20:53:26 (none) Stats: 247 frontpanel 
Mar 31 20:53:26 (none) Stats:  
Mar 31 20:53:26 (none) Stats: Block devices: 
Mar 31 20:53:26 (none) Stats:   1 ramdisk 
Mar 31 20:53:26 (none) Stats:   8 sd 
Mar 31 20:53:26 (none) Stats:  65 sd 
Mar 31 20:53:26 (none) Stats:  66 sd 
Mar 31 20:53:26 (none) Stats:  67 sd 
Mar 31 20:53:26 (none) Stats:  68 sd 
Mar 31 20:53:26 (none) Stats:  69 sd 
Mar 31 20:53:26 (none) Stats:  70 sd 
Mar 31 20:53:26 (none) Stats:  71 sd 
Mar 31 20:53:26 (none) Stats: 128 sd 
Mar 31 20:53:26 (none) Stats: 129 sd 
Mar 31 20:53:26 (none) Stats: 130 sd 
Mar 31 20:53:26 (none) Stats: 131 sd 
Mar 31 20:53:26 (none) Stats: 132 sd 
Mar 31 20:53:26 (none) Stats: 133 sd 
Mar 31 20:53:26 (none) Stats: 134 sd 
Mar 31 20:53:26 (none) Stats: 135 sd 
Mar 31 20:53:26 (none) Stats: ++ Network device info ++
Mar 31 20:53:26 (none) Stats: Inter-|   Receive                                                |  Transmit 
Mar 31 20:53:26 (none) Stats:  face |bytes    packets errs drop fifo frame compressed multicast|bytes    packets errs drop fifo colls carrier compressed 
Mar 31 20:53:26 (none) Stats:   eth0:       0       0    0    0    0     0          0         0        0       0    0    0    0     0       0          0 
Mar 31 20:53:26 (none) Stats:     lo:       0       0    0    0    0     0          0         0        0       0    0    0    0     0       0          0

**swinokur** · 04-01-2010, 04:43 PM

super cheap USB-Serial to TTL cables can be purchased here:
http://www.hobbycity.com/hobbycity/s...idProduct=9043

(this article talks about it as well: http://bytesnwires.wordpress.com/200...-serial-cable/ )

At $2.99 each, you might as well buy a bunch so you pay more for cables than shipping.

The nice thing about this adapter is that it is a SiLabs CP2102 chip, and there is driver support for xp/vista/vista64/win7/linux/macos

(hack the end off of the wire and there are 3 wires, tx, rx and gnd...)

Thread: The Series4 (TiVo Premiere) Development Thread

Thread Tools

Rate This Thread

Display

Series4 Motherboard Photos

Posting Permissions