The Series5 (Tivo Roamio) Development Thread

[Omikron]

At this point I think the most helpful thing would be tracking down more of the datasheets and tracing the pin outs of the main chips. Even the less technically inclined can help in that area.



I'd guess the same on the JTAG as well. It'd be a pretty big oops if not. The eMMC is different in purpose over the PROM in that it holds the OS as well. Just my thought is there's probably some, presumably disabled, way of telling it to boot of some other media. It'd make sense from the development perspective.

Yep. Working on both of those points at the moment. :-)

[AlphaWolf]

Most likely the JTAG fuse in the Broadcom CPU is blown. There's no reason they wouldn't blow it, and since it was blown on the S4, it's got to be blown here as well. Still, no reason not to try anyway...

My guess is that it behaves the same way the other platforms do when you remove the PROM, which is for the CPU to halt.

It turns out that CableLabs completely forbids any kind of debug or developer access ports (such as jtag) in any CableLabs certified device. This would probably explain why S3 and beyond don't have a serial port, whereas all previous models did (though they did have a poorly hidden TTL port.)

Anyways, I recall during my S3 hacking days that parts of the PROM were read and executed while tivoapp (or swedishchef as I think it's now called?) was live. I learned this inadvertently when the tivo locked up when I pulled the PROM out of a live system, and only booting the tivo in a "bare" state (e.g. terminating rc.sysinit early in the boot stage) allowed me to use a live tivo to reprogram a prom chip (because I didn't have any actual tools for reprogramming one.)

Aside from the sata idea I came up with earlier, I was thinking alternatively you could *possibly* figure out what portions are read and swap out the prom early in the boot stage (but after the prom has done its signing checks.) Wouldn't be a permanent solution, but it would at least allow you to gain initial entry and learn more about how they work.

[philhu]

So, I am assuming the S4 and now S5 development is dead?

Nothing new to report?

[GaveUp]

So, I am assuming the S4 and now S5 development is dead?

Nothing new to report?

I'd say the shellshock thread answers that question.

Yep. Working on both of those points at the moment. :-)

Any luck on the datasheet front?

[Throg]

Hi everyone. it's good to see some familiar names still around here. I got a 4TB Roamio Plus and love it. I just miss all of the hacks that I became accustomed to on my S2 units. I toyed around a little with KMTTG but it's nothing like the old days.

Anyway, I just wanted to introduce myself to the forum and let y'all know that I am here. I was inactive long enough that I had to recreate my account so my coolness has worn off.

That's all.

[Roger Dylan]

Hi everyone. it's good to see some familiar names still around here. I got a 4TB Roamio Plus and love it. I just miss all of the hacks that I became accustomed to on my S2 units. I toyed around a little with KMTTG but it's nothing like the old days.

The only relevance of old time hacking to the Roamio (i.e. the current situation) is that it's still worth having a hacked s3/HD with the cci bytes disabled in your mix if you're still getting channels within the tuning capability of the s3/HD that have the cci bytes set. Once recorded on the s3/HD, shows from those channels can be transferred by standard means to the Roamio and your home net with full functionality.

For example my Cable provider is crippling 8 channels I'm paying for. Two of them they've gone to mpeg4 so they are lost (until the mpeg4 s3/HD hack surfaces, if ever) but the other 6, though crippled as directly recorded on the Roamio, are still useful in my home network via the s3/HD entry point.

But hacking older Tivos is ultimately a lost cause with mpeg4 inevitable. Again, absent the mpeg4 hack for the s3/HD.

[cj47]

The links in the 1st post are dead.
Any chance of re-posting the hi-rez board shots??

[RWS3]

The only relevance of old time hacking to the Roamio (i.e. the current situation) is that it's still worth having a hacked s3/HD with the cci bytes disabled in your mix if you're still getting channels within the tuning capability of the s3/HD that have the cci bytes set. Once recorded on the s3/HD, shows from those channels can be transferred by standard means to the Roamio and your home net with full functionality.

For example my Cable provider is crippling 8 channels I'm paying for. Two of them they've gone to mpeg4 so they are lost (until the mpeg4 s3/HD hack surfaces, if ever) but the other 6, though crippled as directly recorded on the Roamio, are still useful in my home network via the s3/HD entry point.

But hacking older Tivos is ultimately a lost cause with mpeg4 inevitable. Again, absent the mpeg4 hack for the s3/HD.

My TiVo HD has served me well. I pay per seat for cable cards. The newer TiVos can stream, so there has been progress for the consumer. Still, the S3 and HD mods have been super useful. Too bad the Premiere and Roamio have put a damper on everything. Still, many thanks.

[philhu]

Well, since tivoHD now has mpeg4 on 11.0n, GAME ON!!!!!!!!

I just resurrected my 2 hacked tivoHD units, CCI bit on, GAME ON!