Page 2 of 14 FirstFirst 123412 ... LastLast
Results 16 to 30 of 204

Thread: The Series4 (TiVo Premiere) Development Thread

  1. #16
    Join Date
    Jul 2005
    Posts
    574
    Quote Originally Posted by tivo4mevo View Post
    Based upon the OTP bits described in the Flash data sheet, the boot code is likely locked.
    I was thinking the same thing, but we can use this to our (small) advantage. Whereas before there was some question as to whether or not TiVo was capable of remote-flashing the PROM, setting the OTP bits in the flash in new PROM chips could guarantee that the modified code isn't over written by any future updates.
    .-=Omikron=-.

    TiVo Series4 Premiere Development HERE

    Do you have a PROM related question? Check HERE and HERE before sending me a PM. Any questions that have already been answered will be deleted if sent via PM.

  2. #17
    Join Date
    Jan 2002
    Location
    Sonoran Desert
    Posts
    2,829
    I notice there are several unused footprints on the motherboard, one resembling a jtag header. I don't suppose anybody would have the technical skill necessary to work out a solution similar to game console mod chips? E.g. no tsop removal necessary, just solder in a daughterboard that circumvents the tsop substituting its own boot code.
    Before PMing me: Iím not your personal tech support. If you have a question, ask in public so I don't have to repeat if somebody else asks. If you want images or slices, use emule. I will ignore all support PMs.

    Sponsor a vegetarian! I have taken the pledge, how about you?

  3. #18
    Join Date
    Jul 2005
    Posts
    574
    Quote Originally Posted by AlphaWolf View Post
    I notice there are several unused footprints on the motherboard, one resembling a jtag header. I don't suppose anybody would have the technical skill necessary to work out a solution similar to game console mod chips? E.g. no tsop removal necessary, just solder in a daughterboard that circumvents the tsop substituting its own boot code.
    Something like this may indeed be possible, but the initial design would very likely take a great deal of work and significant skill. In matters of console modchips, the sheer amount of work needed to pull something like that off is offset by the gobs of money modchip makers make.

    In a small community driven environment like this where only a very few handful of people are interested, it's much harder to find someone who's willing to put forth the resources to develop and maintain it. I know a few people that would probably be able to pull something like that off, but not without throwing piles of cash at them.
    .-=Omikron=-.

    TiVo Series4 Premiere Development HERE

    Do you have a PROM related question? Check HERE and HERE before sending me a PM. Any questions that have already been answered will be deleted if sent via PM.

  4. #19
    Join Date
    May 2004
    Posts
    247
    Quote Originally Posted by AlphaWolf View Post
    I notice there are several unused footprints on the motherboard, one resembling a jtag header. I don't suppose anybody would have the technical skill necessary to work out a solution similar to game console mod chips? E.g. no tsop removal necessary, just solder in a daughterboard that circumvents the tsop substituting its own boot code.
    Completely different things.

    I can speak for how it works on a Wii - what keeps a homemade disc from containing non-approved content is some info stored in a way it can't be written with a CD-R writer. The chips work by injecting code into the Wii's CD controller, and that code always tells the Wii itself that the disc is approved. It takes advantage of a diagnostic capability of the CD chip, and the code gets stored in the RAM of that chip. They are NOT overriding any flash/(EP)ROMs, etc.

    You can't override a ROM using JTAG (at least not in real-time, which is what's needed here). It just doesn't work that way. You might, however, be able to re-program the flash ROM using JTAG

  5. #20
    Join Date
    Jul 2005
    Posts
    574
    We should keep in mind that the PROM on this platform does have OTP bits that can be set, blocking further write access to the chip. If such bits have been set, then creating any type of add-on adapter is going to be much, much more difficult.
    .-=Omikron=-.

    TiVo Series4 Premiere Development HERE

    Do you have a PROM related question? Check HERE and HERE before sending me a PM. Any questions that have already been answered will be deleted if sent via PM.

  6. #21
    Join Date
    Jul 2005
    Posts
    574
    Well, I decided to cancel my pre-order and just pick one up from Best Buy today. So, I now have a Premiere in-hand but alas no other hardware to interface with the PROM yet.

    I'll try to tinker around with other things in the mean time. :-)
    .-=Omikron=-.

    TiVo Series4 Premiere Development HERE

    Do you have a PROM related question? Check HERE and HERE before sending me a PM. Any questions that have already been answered will be deleted if sent via PM.

  7. #22
    Join Date
    Jun 2006
    Location
    Dougal County
    Posts
    1,014
    Quote Originally Posted by Omikron View Post
    Well, I decided to cancel my pre-order and just pick one up from Best Buy today. So, I now have a Premiere in-hand but alas no other hardware to interface with the PROM yet.

    I'll try to tinker around with other things in the mean time. :-)
    Code:
    for x in 3 4 6 7 9
    do
    dd if=/dev/hda$x | gzip -9n > hda$x.gz
    done

  8. #23
    Join Date
    Jul 2005
    Posts
    574
    In other news, in my INFINITE WISDOM I sold my own TTL adapter a while ago to someone who really wanted one, thinking that I would simply replace it later. It seems that I forgot to replace it... :-/

    ::grumble::

    Time to buy a new adapter.
    .-=Omikron=-.

    TiVo Series4 Premiere Development HERE

    Do you have a PROM related question? Check HERE and HERE before sending me a PM. Any questions that have already been answered will be deleted if sent via PM.

  9. #24
    Join Date
    Jan 2002
    Location
    Sonoran Desert
    Posts
    2,829
    Quote Originally Posted by mike_s View Post
    Completely different things.

    I can speak for how it works on a Wii - what keeps a homemade disc from containing non-approved content is some info stored in a way it can't be written with a CD-R writer. The chips work by injecting code into the Wii's CD controller, and that code always tells the Wii itself that the disc is approved. It takes advantage of a diagnostic capability of the CD chip, and the code gets stored in the RAM of that chip. They are NOT overriding any flash/(EP)ROMs, etc.

    You can't override a ROM using JTAG (at least not in real-time, which is what's needed here). It just doesn't work that way. You might, however, be able to re-program the flash ROM using JTAG
    I was thinking more along the lines of the original xbox. That was simply a matter of breaking the chain of trust, just like a tivo. Mod chips for that would simply plug in to the jtag footprint and a single via hole which made the xbox basically ignore the onboard tsop and boot from a tsop contained in the daughterboard instead.

    Or if you wanted to you could just replace the tsop with a reprogrammed one entirely, and some people did it this way. This is the same thing we do with tivos right now.

    I imagine you can't do a similar thing for the wii due to the boot code being contained read only in some sort of asic that also handles much if not all of the central processing. I wouldn't know though as I've never owned one. Tivo's certainly don't operate in this manner though.
    Last edited by AlphaWolf; 03-29-2010 at 02:12 AM.
    Before PMing me: Iím not your personal tech support. If you have a question, ask in public so I don't have to repeat if somebody else asks. If you want images or slices, use emule. I will ignore all support PMs.

    Sponsor a vegetarian! I have taken the pledge, how about you?

  10. #25
    Join Date
    Jul 2005
    Posts
    574

    Series4 Motherboard Photos

    Alright, I decided to completely strip down my Series4 to the bare board and take some photos for your voyeuristic pleasure.

    Top:

    Here's a pretty good view of the whole board, very much like the images bkdtv posted.


    Bottom:

    An overall view of the bottom of the board. There is something neat going on here with the two grey thermal interface pads underneath the tuners. It would seem that the tuners put out enough heat that they felt the need to sink the heat directly into the chassis. There are two metal indents in the chassis underneath this area that interfaces directly with these pads.


    Top Left Closeup:

    In this view we can see the battery, the TSOP56 PROM, and an empty location next to it that looks like a TSOP48 chip of some sort. I'm not really sure why there's a second spot here. It's possible that TiVo wasn't sure if it was going to use a TSOP56 flash or a TSOP48 flash, but it doesn't make sense that they would leave it there. The PROM flash chip, like the platforms before it, has a silk-screened area for where the socket would align around it. Also of note is the SW1 switch that seems to be missing from the board in the top left area. It's possible that this switch would be used during development to perform some sort of reset function, so it will be interesting to see what it does.

    Top Right Closeup:

    Nothing too interesting here it seems. More scattered unpopulated debug headers.


    Bottom Right Closeup:

    In the center of this image we can see the 4 pin TTL serial header which the TiVo HD used. Of note is the large area in the tuners that seems to be completely unpopulated. I do wonder what it could have held, and perhaps more poking and prodding will tell us. There is also a mysterious 5 pin header in the upper left area here that leads directly to the CPU. The header is surrounded by a grounding pin on each side, and I haven't been able to determine what type of connector would fit in there. Any ideas here would be welcome.


    Bottom Left Closeup:

    There are some really interesting things going on here. We can see lots of unpopulated areas here for both pin headers and capacitors, neither of which would allow the CableCard slot to be there had they been populated. This would seem to imply that the development versions of this board did not even have a CableCard slot, and perhaps interfaced to a "CableCARD Test Device" of some sort. Note that one of the pin headers leading directly to the CPU has a pin count of 14, which would indicate that it may in fact be a JTAG header. I will see if I can investigate this further over the coming weeks. I will probably have to make a ribbon cable that I can solder to the bottom of the board, and bring up the pins to the top in a way that wouldn't interfere with the CableCARD.
    .-=Omikron=-.

    TiVo Series4 Premiere Development HERE

    Do you have a PROM related question? Check HERE and HERE before sending me a PM. Any questions that have already been answered will be deleted if sent via PM.

  11. #26
    Join Date
    Jul 2005
    Posts
    574
    03/30: Enough donations came in to cover the cost of some sockets and test chips. Still a bit away from the socket adapter needed for programming, but there are other things to look at while we're all waiting. :-)
    .-=Omikron=-.

    TiVo Series4 Premiere Development HERE

    Do you have a PROM related question? Check HERE and HERE before sending me a PM. Any questions that have already been answered will be deleted if sent via PM.

  12. #27
    Join Date
    Jan 2002
    Location
    Sonoran Desert
    Posts
    2,829
    Quote Originally Posted by Omikron View Post
    In this view we can see the battery, the TSOP56 PROM, and an empty location next to it that looks like a TSOP48 chip of some sort. I'm not really sure why there's a second spot here. It's possible that TiVo wasn't sure if it was going to use a TSOP56 flash or a TSOP48 flash, but it doesn't make sense that they would leave it there.
    I was thinking about that myself, hell they even pre-soldered the pads. I'm wondering if there may be some way of making the tivo ignore the 56 and use the 48 instead if you simply put one on there. If so you could potentially hack the tivo using nothing more than bit of heat.
    Before PMing me: Iím not your personal tech support. If you have a question, ask in public so I don't have to repeat if somebody else asks. If you want images or slices, use emule. I will ignore all support PMs.

    Sponsor a vegetarian! I have taken the pledge, how about you?

  13. #28
    Join Date
    Jul 2005
    Posts
    574
    Quote Originally Posted by AlphaWolf View Post
    I was thinking about that myself, hell they even pre-soldered the pads. I'm wondering if there may be some way of making the tivo ignore the 56 and use the 48 instead if you simply put one on there. If so you could potentially hack the tivo using nothing more than bit of heat.
    While it would be marginally easier to simply add a new flash and cut some traces to disable the old one, I'm not sure the trade-off is worth it.

    Advantages:

    + Doesn't require the hot-air rework or ChipQuik to remove old TSOP package.

    Disadvantages:

    - Requires physically damaging traces on the motherboard in order to work (assuming you're still trying to take advantage of not having to desolder the old chip).
    - Programming requires an overpriced TSOP48 programming adapter.
    - It may be difficult to find a TSOP48 packages that matches the same design characteristics of the StrataFlash chip from Intel.


    Considering I still don't even have the TSOP56 adapter needed to read the chip, let alone write new ones, it doesn't feel like such a hack would be a high priority.

    That said, the idea is still neat, and I admit that I'm a bit curious if it were be possible even if there were no "good" reasons for doing it. :-)
    .-=Omikron=-.

    TiVo Series4 Premiere Development HERE

    Do you have a PROM related question? Check HERE and HERE before sending me a PM. Any questions that have already been answered will be deleted if sent via PM.

  14. #29
    Join Date
    Jul 2005
    Posts
    574
    I finally got around to connecting the Series4 drive to my PC to grab some of the partitions off of it.

    The good news is that I now have gzip'd copies of partitions 1-9. The bad news is that somehow int the process I managed to make the drive unbootable. The TiVo now gets stuck at a "Almost there..." screen, so I'll have to pull it again and see if there's any useful info in the logs.

    Either way, here's the initial PROM boot log from the messages log:

    Code:
    Mar 31 20:52:52 (none) syslogd 1.5.0: restart.
    Mar 31 20:53:25 (none) Stats: == System startup resource statistics ==
    Mar 31 20:53:25 (none) Stats: ++ System build version numbers ++
    Mar 31 20:53:25 (none) Stats: b-14-1-mr @384589 2010.03.19-1443 release-mips_k26 [] ARM_IDL_FREEZE CDDB_QUERY DCT_SERIAL DSS_SERIAL HPK IDL_FREEZE IRBLAST LOCAL_CALYPSO_SERVER LOCAL_MP3_PLAYER LOCAL_MUSIC_PLAYER LOCAL_PHOTO_VIEWER LOCAL_WMA_PLAYER MACROVISION MULTI_ROOM_VIEWING PERF_LOGGER PERF_LOGGER_USER_STATS PTHREADS_TMK REQUIRE_PRODUCTION_SPIGOT_LINEAGE SANITIZE_LOGS STRONG_CRYPTO T2KSOURCE US_CABLE_AUTO_DETECT WMDRMPD 
    Mar 31 20:53:25 (none) Stats: 2010.03.19-1443 14.1-01-3 
    Mar 31 20:53:25 (none) Stats: PROM version: Gen07 release 1.00 (2009-10-20 14:09:37)
    Mar 31 20:53:25 (none) Stats: Version : Gen07 release 1.00 (2009-10-20 14:09:37) SHA : 356515097AED79CCEC5097DA723F8FE654826A83 
    Mar 31 20:53:25 (none) Stats: System Serial Number: 746XXXXXXXXXX
    Mar 31 20:53:25 (none) Stats: Linux version 2.6.18-5.1 (build@buildmaster74) (gcc version 3.3.4) #1 Mon Mar 15 10:01:56 PDT 2010 
    Mar 31 20:53:25 (none) Stats: ++ Memory usage ++
    Mar 31 20:53:25 (none) Stats: MemTotal:       329200 kB 
    Mar 31 20:53:25 (none) Stats: MemFree:        256240 kB 
    Mar 31 20:53:25 (none) Stats: Buffers:          1456 kB 
    Mar 31 20:53:25 (none) Stats: Cached:          49300 kB 
    Mar 31 20:53:25 (none) Stats: SwapCached:          0 kB 
    Mar 31 20:53:25 (none) Stats: Active:          18500 kB 
    Mar 31 20:53:25 (none) Stats: Inactive:        36876 kB 
    Mar 31 20:53:25 (none) Stats: HighTotal:           0 kB 
    Mar 31 20:53:25 (none) Stats: HighFree:            0 kB 
    Mar 31 20:53:25 (none) Stats: LowTotal:       329200 kB 
    Mar 31 20:53:25 (none) Stats: LowFree:        256240 kB 
    Mar 31 20:53:25 (none) Stats: SwapTotal:      131064 kB 
    Mar 31 20:53:25 (none) Stats: SwapFree:       131064 kB 
    Mar 31 20:53:25 (none) Stats: Dirty:              88 kB 
    Mar 31 20:53:25 (none) Stats: Writeback:           0 kB 
    Mar 31 20:53:25 (none) Stats: AnonPages:        4656 kB 
    Mar 31 20:53:25 (none) Stats: Mapped:           9384 kB 
    Mar 31 20:53:25 (none) Stats: Slab:            11936 kB 
    Mar 31 20:53:25 (none) Stats: PageTables:        864 kB 
    Mar 31 20:53:25 (none) Stats: NFS_Unstable:        0 kB 
    Mar 31 20:53:25 (none) Stats: Bounce:              0 kB 
    Mar 31 20:53:25 (none) Stats: CommitLimit:    295664 kB 
    Mar 31 20:53:25 (none) Stats: Committed_AS:    33216 kB 
    Mar 31 20:53:25 (none) Stats: VmallocTotal:  1048524 kB 
    Mar 31 20:53:25 (none) Stats: VmallocUsed:      3536 kB 
    Mar 31 20:53:25 (none) Stats: VmallocChunk:  1041352 kB 
    Mar 31 20:53:25 (none) Stats: ++ CPU info ++
    Mar 31 20:53:25 (none) Stats: system type^I^I: BCM97xxx Settop Platform 
    Mar 31 20:53:25 (none) Stats: build target^I^I: unknown 
    Mar 31 20:53:25 (none) Stats: processor^I^I: 0 
    Mar 31 20:53:25 (none) Stats: cpu model^I^I: BMIPS4380 V4.4  FPU V0.1 
    Mar 31 20:53:25 (none) Stats: cpu MHz^I^I^I: 402.43 
    Mar 31 20:53:25 (none) Stats: BogoMIPS^I^I: 402.43    ( udelay_val : 201216  HZ = 1000 ) 
    Mar 31 20:53:25 (none) Stats: wait instruction^I: yes 
    Mar 31 20:53:25 (none) Stats: microsecond timers^I: yes 
    Mar 31 20:53:25 (none) Stats: tlb_entries^I^I: 32 
    Mar 31 20:53:25 (none) Stats: extra interrupt vector^I: yes 
    Mar 31 20:53:25 (none) Stats: hardware watchpoint^I: no 
    Mar 31 20:53:25 (none) Stats: ASEs implemented^I: mips16 
    Mar 31 20:53:25 (none) Stats: VCED exceptions^I^I: not available 
    Mar 31 20:53:25 (none) Stats: VCEI exceptions^I^I: not available 
    Mar 31 20:53:25 (none) Stats: RAC setting^I^I: Unknown 
    Mar 31 20:53:25 (none) Stats: unaligned access^I: 0 
    Mar 31 20:53:25 (none) Stats: rdhwr/brdhwr traps^I: 0 / 0 
    Mar 31 20:53:25 (none) Stats: cycle counter frequency^I: 27046875 
    Mar 31 20:53:25 (none) Stats: ++ Module info ++
    Mar 31 20:53:26 (none) Stats: router 68608 0 - Live 0xc005d000 
    Mar 31 20:53:26 (none) Stats: ubuddy 7808 0 - Live 0xc0017000 
    Mar 31 20:53:26 (none) Stats: pod 15680 2 - Live 0xc003a000 
    Mar 31 20:53:26 (none) Stats: tv_bcm7405 37056 0 - Live 0xc0052000 
    Mar 31 20:53:26 (none) Stats: bcm7405 2986848 65 tv_bcm7405, Live 0xc0426000 
    Mar 31 20:53:26 (none) Stats: tr 4736 2 - Live 0xc002a000 
    Mar 31 20:53:26 (none) Stats: nxp7164 47840 12 - Live 0xc0045000 
    Mar 31 20:53:26 (none) Stats: drx 234640 22 - Live 0xc0080000 
    Mar 31 20:53:26 (none) Stats: ircatch 9344 0 - Live 0xc002f000 
    Mar 31 20:53:26 (none) Stats: frontpanel 2752 1 ircatch, Live 0xc001a000 
    Mar 31 20:53:26 (none) Stats: i2c 9024 2 ubuddy,drx, Live 0xc0026000 
    Mar 31 20:53:26 (none) Stats: softi2c 9088 1 bcm7405, Live 0xc0022000 
    Mar 31 20:53:26 (none) Stats: gpio 10688 5 pod,drx,softi2c, Live 0xc001e000 
    Mar 31 20:53:26 (none) Stats: ++ Device info ++
    Mar 31 20:53:26 (none) Stats: Character devices: 
    Mar 31 20:53:26 (none) Stats:   1 mem 
    Mar 31 20:53:26 (none) Stats:   2 pty 
    Mar 31 20:53:26 (none) Stats:   3 ttyp 
    Mar 31 20:53:26 (none) Stats:   4 ttyS 
    Mar 31 20:53:26 (none) Stats:   5 /dev/tty 
    Mar 31 20:53:26 (none) Stats:   5 /dev/console 
    Mar 31 20:53:26 (none) Stats:   5 /dev/ptmx 
    Mar 31 20:53:26 (none) Stats:  10 misc 
    Mar 31 20:53:26 (none) Stats:  21 sg 
    Mar 31 20:53:26 (none) Stats:  30 tvbcmdriver 
    Mar 31 20:53:26 (none) Stats:  33 nexus 
    Mar 31 20:53:26 (none) Stats:  97 ubuddy 
    Mar 31 20:53:26 (none) Stats:  99 i2c 
    Mar 31 20:53:26 (none) Stats: 104 router 
    Mar 31 20:53:26 (none) Stats: 108 ppp 
    Mar 31 20:53:26 (none) Stats: 111 pod 
    Mar 31 20:53:26 (none) Stats: 112 drx 
    Mar 31 20:53:26 (none) Stats: 114 tr 
    Mar 31 20:53:26 (none) Stats: 121 saa7164 
    Mar 31 20:53:26 (none) Stats: 127 ircatch 
    Mar 31 20:53:26 (none) Stats: 128 ptm 
    Mar 31 20:53:26 (none) Stats: 136 pts 
    Mar 31 20:53:26 (none) Stats: 180 usb 
    Mar 31 20:53:26 (none) Stats: 189 usb_device 
    Mar 31 20:53:26 (none) Stats: 243 gioctl 
    Mar 31 20:53:26 (none) Stats: 246 gpio 
    Mar 31 20:53:26 (none) Stats: 247 frontpanel 
    Mar 31 20:53:26 (none) Stats:  
    Mar 31 20:53:26 (none) Stats: Block devices: 
    Mar 31 20:53:26 (none) Stats:   1 ramdisk 
    Mar 31 20:53:26 (none) Stats:   8 sd 
    Mar 31 20:53:26 (none) Stats:  65 sd 
    Mar 31 20:53:26 (none) Stats:  66 sd 
    Mar 31 20:53:26 (none) Stats:  67 sd 
    Mar 31 20:53:26 (none) Stats:  68 sd 
    Mar 31 20:53:26 (none) Stats:  69 sd 
    Mar 31 20:53:26 (none) Stats:  70 sd 
    Mar 31 20:53:26 (none) Stats:  71 sd 
    Mar 31 20:53:26 (none) Stats: 128 sd 
    Mar 31 20:53:26 (none) Stats: 129 sd 
    Mar 31 20:53:26 (none) Stats: 130 sd 
    Mar 31 20:53:26 (none) Stats: 131 sd 
    Mar 31 20:53:26 (none) Stats: 132 sd 
    Mar 31 20:53:26 (none) Stats: 133 sd 
    Mar 31 20:53:26 (none) Stats: 134 sd 
    Mar 31 20:53:26 (none) Stats: 135 sd 
    Mar 31 20:53:26 (none) Stats: ++ Network device info ++
    Mar 31 20:53:26 (none) Stats: Inter-|   Receive                                                |  Transmit 
    Mar 31 20:53:26 (none) Stats:  face |bytes    packets errs drop fifo frame compressed multicast|bytes    packets errs drop fifo colls carrier compressed 
    Mar 31 20:53:26 (none) Stats:   eth0:       0       0    0    0    0     0          0         0        0       0    0    0    0     0       0          0 
    Mar 31 20:53:26 (none) Stats:     lo:       0       0    0    0    0     0          0         0        0       0    0    0    0     0       0          0
    .-=Omikron=-.

    TiVo Series4 Premiere Development HERE

    Do you have a PROM related question? Check HERE and HERE before sending me a PM. Any questions that have already been answered will be deleted if sent via PM.

  15. #30
    Join Date
    Mar 2003
    Posts
    176
    super cheap USB-Serial to TTL cables can be purchased here:
    http://www.hobbycity.com/hobbycity/s...idProduct=9043

    (this article talks about it as well: http://bytesnwires.wordpress.com/200...-serial-cable/ )

    At $2.99 each, you might as well buy a bunch so you pay more for cables than shipping.

    The nice thing about this adapter is that it is a SiLabs CP2102 chip, and there is driver support for xp/vista/vista64/win7/linux/macos

    (hack the end off of the wire and there are 3 wires, tx, rx and gnd...)

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •