Series 2 Stand Alone - Still unhackable?

[NHRA21]

I have been out of the loop for some time now. I did a hard drive upgrade on my TiVo, but not much else. Has any head way been made on hacking these, or does the eprom still need to be changed? Can someone point me in the right direction?

Thanks,
-Sean

[Gunnyman]

yes the Nightlight Tivos Starting with teh TCD 54xx series need prom mods till.

[Chris97]

I am very sorry to have to ask this, but... I have been all over this forum (or so I think), and I still cant find a file needed to mod the prom. I have a TCD5400 series Tivo with a PLCC32 SST chip. I have the programmer at work, but no file to load to it. Are there any instructions? I have pieced together so far that you have to read the PROM and then edit 4 different lines. If that is all there is to it, no worries. But as with everything else, I dont think it can be that easy. Are there any other special circumstances that need to be fulfilled when reprogramming? Are there any bits that need to be set as "active high" or "active low" with this chip? Thanks for all your help. I dont want to seem like a kiss a$$ here, but you guys really are doing a great job with this stuff. I had no IDEA that Tivo hacking could be so much fun and frustrating at the same time! Thanks in advance for the help.

[Gunnyman]

check on deal database

[nocturno]

The TCD 24XX needs a prom mod too?

Thanks!

[Gunnyman]

nope

[texster]

I see that many have prommodded their tcd 54xx models. But I really don't know why. Unless it is jut for the pure enjoyment of taking a soddering iron to your tivo.

If your goal is enabling telnet and all the other goodies on a standalone, I would think that your best bet is to swap out your tcd54xx for a tcd24xx on ebay. You could probably get it done for even money. At the very least, you end paying less than you would pay to have your prom modded.

[Gunnyman]

the main reason is the alternate way to achieve TTG is way faster than TTG itself :D

[texster]

the main reason is the alternate way to achieve TTG is way faster than TTG itself :D
Now that is discussion I'd like to have, but we can't have it here. Haven't seen it (a comparison of ttg vs the other ways) directly addressed over there - seems like it is just assumed ttg is inferior. Or maybe I need to search better.

But I apologize for being vague, I know TTG is the reason, what I meant to say was, I don't understand why people even try mess with the tcd 54xx prom when the tcd 24xx is readily available on ebay.

[Gunnyman]

ahh

[Gunnyman]

what I don't understand is why we can dalk about directshow dump and not Tivotool or tytool.

[JamieP]

Now that is discussion I'd like to have, but we can't have it here. Haven't seen it (a comparison of ttg vs the other ways) directly addressed over there - seems like it is just assumed ttg is inferior. Or maybe I need to search better.There's been several anecdotal comparisons here at TCF. Here's (http://www.tivocommunity.com/tivo-vb/showthread.php?p=3012141&highlight=TTG#post3012141) mine.

[Gunnyman]

Thanks for that Jamie
Makes me REALLY appreciate my Directivo :D

[texster]

Yes, that is really good info Jamie. Have you compared the transfer times going in the other direction? I don't think it was even possible via TTG at the time of your orignal post.

[JamieP]

Yes, that is really good info Jamie. Have you compared the transfer times going in the other direction? I don't think it was even possible via TTG at the time of your orignal post.No, I haven't compared times for insertion. IIRC, TTG can transfer files to the tivo much faster than from the tivo, so I doubt that you'll see the same performance mismatch there.

I tend to use tivoserver and MRV to transfer files to the tivo, partly because it will autoconvert avi's on the fly.

[Chris97]

Just clear some things up... I have two UltimaTV's from DirecTV. I LOVE them. But there is no way I can get the movies/shows off there in order to record to DVD. It wasnt like I went looking to purchase this Tivo - it kinda fell in my lab. I received a free Tivo from Dockers for buying $100 worth of clothes. Well, I needed some new clothes anyway... What do they send me - the TCD54040. Joy. After reading all this hacking stuff and trying all the software hacks, I find out that I need to do the prom mod. No big deal. I did the aluminum foil/heat gun method. Came right off in 45 seconds. No pop, no forceful push; it just slid over to the side when i touched it with a toothpick. Done. As far as soldering and programming, I do this every other week at my job. Easy for me. Yes, I see your point - for most people, this would be a very big venture, but for me, no problems. Plus, it is fun! My only issue is finding the right file to program back on it. I was told to go to Data Deals (?) website, but all I found there was a description of the 4 lines I will need to modify. Will do later today or tomorrow. Seems someone has "borrowed" the programmer out of the lab. Argh. Thanks again for all the info.

[Chris97]

Ok. Found the programmer. Got the file off the flash chip. The patches that were made to other 2.5 series flash do not match anything in my EPROM dump. The sticker on the prom said it was version 2.28.1. Other posts I have seen around are talking about version 2.25. Any suggestions? Does anyone have a copy of the entire prom file? I saved the file as a binary. Should I have saved it as ASCII? Is asking for the prom file bad form, that is, is that illegal to ask for it? I do not want to breach any forum etiquette here. Thanks again.

[Chris97]

Ok. Found problem. I was saving as Intel Binary, not straight Binary. Made three changes:

2.28.1 Changes:
6a70 = 14830004 -> 14840004 (disable prom sha-160)
79a4 = 1043000a -> 1042000a (disable kernel check)
5868 = 10400011 -> 00000000 (enable debug msgs)

but the fourth is the "skip memchk" hack. I cannot find the correlation between what others have changed, and what I SHOULD change. That is, I have found 2 different changes that people have made, but the patterns do not match:

person 1:
35f8 = 0c771940 00000000 0440ff97 -> 0c7718d7 00000000 24020000 (skip memchk)

person 2:
9f88 = 0c771ac1 00000000 0440ff95 -> 0c771a83 00000000 24020000 (skip memchk)

Mine:
746C = 0c771afd 00000000 0440ff95 -> ???????? 00000000 2402000 (skip memchk)

Any suggestions? I am going to try without the "skip memchk" hack and see if it is integral. Will post again tomorrow.

[Lannister80]

Thanks for working on this Chris, I'm interested to see if it works or not.

If so, can you post the modified version of the flash file to make it easier for other folks?

[Chris97]

Well, I plugged it in....and no go. I have since not brought the chip back to work to reprogram, but rest assured, I will find the solution. Will post again when further progress warrants a post. :)

[Gunnyman]

is the roadmap to doing this not over on DDB?

[papu66]

I opened my TIVO (540040) and see that i have the same PROM 2.28.1.

Chris97 / Lannister80 - Did you guys have success with the mod ? If so can you update the list of changes.

I have the modified 2.25 bin. Would i be able to use that for my box? Has anyone tried it ?

Thank you.