TiVo Community Forums Archives - New PROM in Series2 download of OS 3.2

TiVoCommunity.com
(c)opyright 1995-2005 All rights reserved
indexcheckTC
This area is a static history of posts in the TiVo Community Forum Archive.
This archive history was made for the simple indexing of search sites like Google.

Pages:1

New PROM in Series2 download of OS 3.2
(Click here to view the original thread with full colors/images)

Posted by: rhobite

Good Afternoon,

I need some direction on where to proceed from here. I may have stumbled upon something that could be helpful in our quest to unlock the TiVo series2. Please correct me if I'm wrong, but I believe this is what happened: Last night's service data download apparently contained OS 3.2, and my TiVo grabbed it. I have an AT&T unit that is currently running OS 3.0. It is unmodified but I have previously taken out the HD and done a backup.

While browsing through the system info screen, I saw a number of 'icebox' files with names such as GZkernel, GZbin, and yes: GZprom. Could this indicate that the PROM is flashable in-system? If this is really a PROM image that is destined to be flashed, I think I should grab it off the box before it goes away. Who knows if my TiVo will reboot tonight, install 3.2, and delete all these potentially useful files. Would it be useful for me to grab an image of the disk, or grab certain files off the drive? Are the icebox files on a user-readable (non-MFS) filesystem?

Here are the filenames from the tclient logfile:

SwSystem/3.2.V4-01-2/GZbin-7507180-1.slice.gz
SwSystem/3.2.V4-01-2/GZetc-7507182-1.slice.gz
SwSystem/3.2.V4-01-2/GZkernel-7507184-1.slice.gz
SwSystem/3.2.V4-01-2/GZlib-7507186-1.slice.gz
SwSystem/3.2.V4-01-2/GZprom-7507188-1.slice.gz
SwSystem/3.2.V4-01-2/GZsbin-7507190-1.slice.gz
SwSystem/3.2.V4-01-2/GZtvbin-7507192-1.slice.gz
SwSystem/3.2.V4-01-2/GZtvlib-7507194-1.slice.gz
SwSystem/3.2.V4-01-2/swsystem-7507302-53.slice.gz
SwSystem/3.2.V4-01-2/utils-7507196-1.slice.gz

The rest of the files were Showcase files and I left them out.

OK, I'm not a TiVo hacker but I'm a professional software developer. I can do this but I may have questions. How should I proceed? I am probably going to shut down the old TiVo (125 days uptime.. sigh) and see what I can grab off the HD. The prom image would probably be the most useful, in addition to any flashing code. Where should I look for possible flashing software? Install scripts? I will also try to find the logs of last night's download, I'm assuming they're in the /var tree somewhere.

I will do what I can to provide any info I get.

Posted by: Tiger

The prom has always been included in software updates. It has never been in-field updated however.

Posted by: rhobite

Ah well. I got a little excited but I figured someone had gone down this road before. Any idea why they send down the PROM if they never update it live?

I grabbed backups of all useful partitions, just in case.. partition table, kernel, root 1, /var, both MFS application partitions. The SwSystem files are on the MFS application partitions, but I'm assuming there is no way to read them there, correct?

edit: I searched the partitions for any gzip headers (0x1F8B08) and the files are there. Assuming they're not fragmented, they should be trivial to read. I did read the prom and the uncompressed filename turned out to be prom-3.0-01-2.cpio. It runs the updateprom, in sbin. Since updateprom is pretty visible, I'm assuming someone already investigated whether this is runnable on series2, and I'm assuming the answer is no.

Thanks for the reply.

Posted by: Tiger

They are most likely fragmented. The way MFS works, only small files or files of even powers of 2 are not fragmented. And even then they could be.

As to if updateprom could be run... Well if you could run it, you could run whatever else you wanted.

Posted by: ADent

I am pretty sure somebody has updated the PROM file on a S1 box from the files TiVo provided (wasn't that way back with 2.0?).

But like Tiger said, how you get updateprom to run on a S2 box?

Posted by: rhobite

Well, on one of the big S2 hacking threads, someone mentioned there was no possibility of flashing on an S2 because it was disabled in hardware, and they had "read the specs" to prove it. It would be useful to know whether the S2 box itself can flash the PROM, or if that line is totally disabled which would mean any PROM-based hack would have to be soldered in.

If it were possible for S2 to flash itself (and I have a hunch that it is) you could do some sort of one-time hack - i.e. hot plugging the IDE drive, or some intermediate IDE device.. or an exploit such as the PNG exploit which has been suggested. You'd only have to do it once, to get a hacked PROM image flashed. Then if TiVo fixed the exploit you would still have a PROM which allowed you to boot an unprotected kernel. My point is, people will go to greater lengths if it is only one time - for instance nobody likes the PSX/PS2 swap tricks, since you ahve to do them every time. But many people don't mind soldering in a modchip just once.

Posted by: jafa

Hi,

The chip that they use on the production units is a real re-flashable flash chip, but does not include the charge pump - you have to supply an external 12V programming voltage. I am sure the 3.3V tolerant MIPS core will be less than happy about 12V being back-fed into one of its output pins.

Nick

Posted by: Smirks

I've had the same ICEBOX files for a couple of days now...

I wonder how long before the get installed? My unit has rebooted at least twice since I noticed those files, but it still shows as running 3.0

Posted by: Dennis Wilkinson

quote:
Originally posted by Smirks
I've had the same ICEBOX files for a couple of days now...

I wonder how long before the get installed? My unit has rebooted at least twice since I noticed those files, but it still shows as running 3.0

I have them myself, on a Series 1 box. It's not entirely clear to me, but if I had to hazard a guess, it would be that they came down off the Teleworld paid broadcast -- they could just be lying in wait for a command to decompress and install to come in during a daily call.

It does strike me as a lot of data for the service download, though...

Posted by: Smirks

quote:
Originally posted by Dennis Wilkinson

I have them myself, on a Series 1 box. It's not entirely clear to me, but if I had to hazard a guess, it would be that they came down off the Teleworld paid broadcast -- they could just be lying in wait for a command to decompress and install to come in during a daily call.

It does strike me as a lot of data for the service download, though...

Interesting... I have a Series2... I guess I'll just have to wait and see how long before they get installed....

Posted by: johng

I'm new to the forum and am a HW Engineer. Most of the new FLASH chips don't require 12V to program them anymore. Some chips (like some of the new Intel parts) allow you to still supply 12V to the Vpp pin to speed up the programming of the chip, but will still program the parts if Vpp is at 3.3V (just takes longer). The Intel and AMD chips have a WP# pin which is a write protect pin that must be at the correct level to program the part. Most of the new FLASH chips also come in BGA or TSOP packages, and BGA parts are not something you can rework without specialized equipment. The TSOP parts could be unsoldered with just a soldering iron and a microscope. Anyways if anyone out there actually has a Series 2 which they have opened and would like to post the exact vendor & part number of the FLASH chip I can look it up and post the specifics.

Even though there have been a couple post saying you can't reflash the part my guess is that it can be done. I've designed many boards that just have a register that needs to be written to, to set the WP# pin to allow the FLASH to be written and then a new image can be stored. It just makes sense for vendors to design boards this way just in case a serious bug is found so that all systems don't need to be recalled.

John

quote:
Originally posted by jafa
Hi,

The chip that they use on the production units is a real re-flashable flash chip, but does not include the charge pump - you have to supply an external 12V programming voltage. I am sure the 3.3V tolerant MIPS core will be less than happy about 12V being back-fed into one of its output pins.

Nick

Posted by: rhobite

I believe my TiVo 3.2 data came from the teleworld broadcast. At least it looks that way from the log files. The broadcast was Monday morning and my recorder also made a daily call after that, so it's hard to tell.. I'll look through the log files again.

John, I will open up my S2 again and let you know what the flash chip might be. I'm decidedly NOT a hardware engineer so I don't really know what it would look like. If you're facing the front of the unit, I believe the flash chip is on the lower left corner of the board.

I do remember there are two chips with heatsinks, I'm assuming these are the MIPS CPU and chipset.. there is another large square tivo-branded chip, doesn't look like a PROM type of chip (too many pins). Also 4 DRAMS, I know what those look like :)

Anyway this is all from memory, I'll check when I get home from work tonight.

Posted by: Smirks

What is a 'teleworld broadcast'? I'm fairly new to the board and to TiVo... I've only had mine for 2 weeks. :)

Posted by: hawkamer

The teleword broadcast is where TiVo can pick up guide data, video clips, etc. It is broadcasted on the Discovery channel at 4:00 a.m. on Mondays, usually. You'll see this listed as "Service Data Download" in the system info screen.

Posted by: johng

You are probablly correct that one of the chips with the heatsink is the MIPs CPU. The other part with a heatsink may be the MPEG2 encoder or I guess it could be the chipset. The PROM chip most likely is an Intel or AMD part as they are the 2 major FLASH vendors (I put links to their datasheets below). The AMD part should have a part number that starts with "AM29" and the Intel part number would probably start with "28F". My guess is they used the 48 pin TSOP (thin part that is about 1/2"x3/4") part as those are the most popular (it definately won't have a heatsink on it). I would also guess that it is located somewhat near the CPU or chipset.

http://www.amd.com/us-en/assets/con...ocs/23579b1.pdf

ftp://download.intel.com/design/flc...ts/29064514.pdf

John

quote:
Originally posted by rhobite
I believe my TiVo 3.2 data came from the teleworld broadcast. At least it looks that way from the log files. The broadcast was Monday morning and my recorder also made a daily call after that, so it's hard to tell.. I'll look through the log files again.

John, I will open up my S2 again and let you know what the flash chip might be. I'm decidedly NOT a hardware engineer so I don't really know what it would look like. If you're facing the front of the unit, I believe the flash chip is on the lower left corner of the board.

I do remember there are two chips with heatsinks, I'm assuming these are the MIPS CPU and chipset.. there is another large square tivo-branded chip, doesn't look like a PROM type of chip (too many pins). Also 4 DRAMS, I know what those look like :)

Anyway this is all from memory, I'll check when I get home from work tonight.

Posted by: Agent86

TiVo broadcasts two programs at 4:00am on Monday mornings on the Discovery Channel.

The "Advanced Paid Program" is a data download. Its a video signal that contains data and survives the mpeg encoding/decoding process. I believe its patented by TiVo.

The "Teleworld Paid Program" now usually consists of videos clips that TiVo will use in the Showcases or Yellow Star advertisements (you'll know one when you see one).

Fun Fact: Teleworld was one of the original names for TiVo.

- Agent 86

Posted by: rhobite

John,

The flash chip is an SST MPF 39VF010. Other markings on the chip are:
70-4C-NH
9935035-D

It is a 1 megabit flash chip. It's square, and I wouldn't call it thin. 7 pins on 2 sides, and 9 pins on the other 2 sides. 32 pins total. I believe this is a PLCC chip? From SST's site:

quote:
The SST39VF512/010/020/040 devices write with a 2.7-3.6V power supply. The devices conform to JEDEC standard pinouts for x8 memories.

So, TiVo's 3.3V should be fine to program the chip. I have attached what I believe is the PROM image.

Posted by: jafa

You have a 39 chip?

Wow!

The ones I have seen have been 37's that need Vpp.

What model have you got?

Nick

Posted by: rhobite

quote:
Originally posted by jafa
You have a 39 chip?

Wow!

The ones I have seen have been 37's that need Vpp.

Hm.. I guess I consider myself lucky then, hopefully I'm in the majority. If everyone has a 37 we won't be getting much done on the ROM hacking front.

Posted by: johng

OK, I've looked through the datasheet. The 70-4C-NH just says that this is a 70nS speed grade part, commercial temperature grade and the 32 pin PLCC package. The last marking is just a manufacturing/date code. The good news is this part doesn't even have a write protect (ie. WP#) pin and the 32 pin PLCC package is the easiest to remove if that ends up needing to be done. No chance they socketed the part, right?

Anyways, if they hooked up pin 31 which is the write enable (not write protect) pin then theorectically the part can be reflashed. Anybody have a scope that they could look at this pin (see datasheet URL below and look at page 4 to see a picture of the part) to see if it ever toggles during reset/poweup? Even if it doesn't that doesn't mean for sure it's not hooked up correctly. Of course someone needs to hookup an in circuit emulator to the CPU and figure out how to disable the checking the boot prom does before it makes any sense to reflash the image.

http://www.sst.com/products/paralle...36_512_data.pdf

John

quote:
Originally posted by rhobite
John,

The flash chip is an SST MPF 39VF010. Other markings on the chip are:
70-4C-NH
9935035-D

It is a 1 megabit flash chip. It's square, and I wouldn't call it thin. 7 pins on 2 sides, and 9 pins on the other 2 sides. 32 pins total. I believe this is a PLCC chip? From SST's site:

So, TiVo's 3.3V should be fine to program the chip. I have attached what I believe is the PROM image.

Posted by: bsnelson

quote:
Originally posted by rhobite
I have attached what I believe is the PROM image.

Has anyone else had problems with extracting the cpio archive? I got the two ".*" files, but I get unexpected EOF while trying to get the actual prom image. Any successes to report?

Brad

Posted by: sorphin

Out of curiousity, is your S2 tivo one of the older S2's or one of the new redesigned S2's w/ the smaller board, etc? if it is a newer one, it might explain the diff chip...

Posted by: kazymyr

quote:
Originally posted by bsnelson
Has anyone else had problems with extracting the cpio archive? I got the two ".*" files, but I get unexpected EOF while trying to get the actual prom image. Any successes to report?

Brad

Same here. Checksum error.

Posted by: rhobite

quote:
Originally posted by sorphin
Out of curiousity, is your S2 tivo one of the older S2's or one of the new redesigned S2's w/ the smaller board, etc? if it is a newer one, it might explain the diff chip...

Sorphin: I am pretty sure it is an older one, after all it is one of the first AT&T TiVo's. Manufactured in October 2001, and I bought it before Series2 was even announced. Are there any differences I should look for on the board? I don't know what to compare it to..

And, to summarize some points that were lost in the crash:

I have an AT&T TiVo with a 39 series chip, it seems most S2 boxes have a 37 chip. The 39 chip is CAPABLE of being programmed in-field, although we don't know if the TiVo has that capability. The 37 chip needs 12V to write, which the TiVo cannot provide and an external power source would probably fry the unit.

The PROM has a white sticker that says "CBOM". Under the sticker you will be able to find the model number of the chip. It is a 32 pin, 9 by 7 PLCC chip. 1 megabit. Johng has been doing some hardware research on how to debug the TiVo's startup process, and it may be possible to connect an external device and observe the signature verification. A simple change in the PROM code may cause the chip to ignore the verification. This is how many software "cracks" work, by changing a branch instruction to a jump or a nop.

My opinion is that PROM hacking is our current best chance to unlock the Series2. I would like to find out which TiVo's have which flash chip, some people have said that most S2's have the 37 chip. The biggest two drawbacks I see, are:

1. Most S2's may have the 37 chip, which would mean you have to remove the chip to reprogram it. This would make it harder to hack, although it's still hard to hack an S2 with a 39 chip because there's the problem of getting your own code to run.

2. TiVo may change the PROM code as a response to people flashing their PROM. They could roll out a new software update, including new PROM code, that didn't work with the existing PROM. This is very unlikely.

Posted by: geowar

Can anyone tell me which MIPS processor the Series2 uses?

BTW: <http://www.levosim.org/> provides a full MIPS emulator. Here's some dissassembly of a ROM image that someone posted somewhere.

ffc00000: 0bf00109 j ffc00424

ffc00424: 3c1abfc0 lui r26,ffffbfc0
ffc00428 241b0000 addiu r27,0,0
ffc0042c a35b0000 sb r27,0(r26)
ffc00430 3c020040 lui r2,40
ffc00434 40826000 cop0
ffc00438 40809000 cop0
ffc0043c 40809800 cop0
ffc00440 40088000 cop0
ffc00444 3c090036 lui r9,36
ffc00448 352966f0 ori r9,r9,66f0
ffc0044c 240d0002 addiu r13,0,2
ffc00450 01094024 and r8,r8,r9
ffc00454 010d4025 or r8,r8,r13
ffc00458 40888000 cop0
ffc0045c 3c1da000 lui sp,ffffa000
ffc00460 27bd1000 addiu sp,sp,1000
ffc00464 0ff0020c jal ffc00830
ffc00468 00000000 nop
ffc0046c 40088000 cop0
ffc00470 3c090036 lui r9,36
ffc00474 352966f0 ori r9,r9,66f0
ffc00478 240d0003 addiu r13,0,3
ffc0047c 01094024 and r8,r8,r9
ffc00480 010d4025 or r8,r8,r13
ffc00484 40888000 cop0
ffc00488 0ff00128 jal ffc004a0
ffc0048c 00000000 nop
ffc00490 3c07a1fe lui r7,ffffa1fe
ffc00494 24e70064 addiu r7,r7,64
ffc00498 00e00008 jr r7

Most of it's pretty strait forward except that I don't know what co-processor it's referring to.

;-)

Posted by: marlborobell

jal is jump and link. Coprocessor #0 is built into the MIPS and standardized; why the disassembler can't figure it out I don't know.

The first instruction puts the contents of register 2 into CP0 register 12, which is the CPU status register, for instance. Natural for that to be one of the first tasks undertaken... (I do low-level MIPS stuff for a living!)

Sometime maybe I'll disassemble the rest, but since I don't have an S2, I can't do a lot right now! (Hey, Kermit, if you're reading this, maybe we ought to get together sometime and figure it out.) Anyway, anybody ought to be able to disassemble it with a decent disassembler (GCC, for instance)or a copy of See MIPS Run.

Posted by: jtl

Is the bootup firmware menu still accessible at all, and does it contain memory-accessing commands?

the similar techniques Replay's using in the 4500 can be circumvented using its boottime monitor's 'copy memory' command, copying nops over a particular branch in the decompressed copy of the second-stage bootloader.

Posted by: rhobite

Anyone with an S2 could take the drive out, mount the disk and grab TiVoProm.bin. It's on one of the ext2 partitions, I forget which. Unfortunately I'm going away for the weekend but I can do that Monday night.

That file I posted was grabbed off of the MFS partition, I thought it might be different than the other TiVoProm.bin since it was labeled 3.2.. but it appears to be the same based on the file name which says 3.0..

Although... I just had this thought, my TiVo shipped with OS 2, does this mean my PROM was updated during the 3.0 rollout?

It's surprising that nobody with MIPS debugging experience has tried this approach.. or at least they haven't chimed in.

Posted by: johng

Some of the posts got wiped out the other day during the crash, but was it ever comfirmed that some of the S2 units actually have the 37 series PROMs (or is it just older TiVo units that have this part)? If it's true that some Series 2 have 37 series FLASH devices and some have 39 series FLASH devices then the comment below about updating the PROM is probablly incorrect. If Series 2 units can be reflashed I think TiVo would have to make it an all or nothing proposition.

Can someone explain why the TiVoProm.bin file is even on the hard disk if it's not for reflashing the PROM?

John

quote:
Originally posted by rhobite
Anyone with an S2 could take the drive out, mount the disk and grab TiVoProm.bin. It's on one of the ext2 partitions, I forget which. Unfortunately I'm going away for the weekend but I can do that Monday night.

That file I posted was grabbed off of the MFS partition, I thought it might be different than the other TiVoProm.bin since it was labeled 3.2.. but it appears to be the same based on the file name which says 3.0..

Although... I just had this thought, my TiVo shipped with OS 2, does this mean my PROM was updated during the 3.0 rollout?

It's surprising that nobody with MIPS debugging experience has tried this approach.. or at least they haven't chimed in.

Posted by: sorphin

Ok peeps,

Here's what i think the deal might be.. he said his tivo is a 2001 made AT&T S2, it's *possible* that the older S2's had 39's and then when they swung into a run in 2002, they went w/ 37s.. because i've had 6 diff S2s (non AT&T) all made over a 4 month period in 2002, and ALL have had 37s..

As for why the prom is on the HD... you need to understand how tivo builds releases... it's automated, no one sits there and does it, it does a build, say of 3.0, it builds it for all possible platforms that 3.0 should be on, packages it up, and there you go.. the only reason the prom is there is because it was packaged up w/ the build.. since 3.2 will only be on S2's and that particular included prom is probably on the new redesigned 80 hours (that actually cool worth a damn i'm sure).. and since they ship w/ 3.2, it makes sense it's part of the build.

just a thought..
-ds

quote:
Originally posted by johng
Some of the posts got wiped out the other day during the crash, but was it ever comfirmed that some of the S2 units actually have the 37 series PROMs (or is it just older TiVo units that have this part)? If it's true that some Series 2 have 37 series FLASH devices and some have 39 series FLASH devices then the comment below about updating the PROM is probablly incorrect. If Series 2 units can be reflashed I think TiVo would have to make it an all or nothing proposition.

Can someone explain why the TiVoProm.bin file is even on the hard disk if it's not for reflashing the PROM?

John

Posted by: puppy

keep talking :)

Posted by: barrey

quote:
Originally posted by rhobite

My opinion is that PROM hacking is our current best chance to unlock the Series2. I would like to find out which TiVo's have which flash chip, some people have said that most S2's have the 37 chip.

Here's a data point:
I have recently completed a drive upgrade on a 60-hour Series 2, and it has the 39 chip.

-Barrey

Posted by: Sirwill

OK.... I do not have an HDVR2. However I do have a very nice ROM burner that I use every day to reprogram roms in Palm PDA's. I haven't found the part number for the 37's posted here yet. If someone can send that to me, I'll see if I have the correct adapter. I know what adapter is needed for the 39 part. It is a 32 pin PLCC. I think with an $80 adapter for my current ROM burner, I could read the entire rom file, edit the file, and relash it out. I need the 37 part number to find out for sure. This would have to be a service as I'd have to unsolder the rom chip, modify it, and reinstall the rom chip. Would anybody be interested in a service that would make these mods?

Posted by: Combat Medic

quote:
Originally posted by Sirwill
OK.... I do not have an HDVR2. However I do have a very nice ROM burner that I use every day to reprogram roms in Palm PDA's. I haven't found the part number for the 37's posted here yet. If someone can send that to me, I'll see if I have the correct adapter. I know what adapter is needed for the 39 part. It is a 32 pin PLCC. I think with an $80 adapter for my current ROM burner, I could read the entire rom file, edit the file, and relash it out. I need the 37 part number to find out for sure. This would have to be a service as I'd have to unsolder the rom chip, modify it, and reinstall the rom chip. Would anybody be interested in a service that would make these mods?

God yes.

-Mike

Posted by: bsnelson

Sirwill, you'd be our hero! Even *I* would have to get a HDVR2! ;)

Brad

Posted by: Sirwill

First things first. I need that 37 Part #. I need to learn about it real quick.

Posted by: geowar

see: <http://www.sst.com/downloads/datasheet/S71150.pdf>

Posted by: Sirwill

quote:
Originally posted by geowar
see: <http://www.sst.com/downloads/datasheet/S71150.pdf>

That link has to do with the 39... I need to know the part number of the 37. Is it EXACTLY the same, but just a 37 instead of a 39?

Will

Posted by: geowar

I don't know; my box has the 39.

Posted by: stevekstevek

It is a SST 37VF010 32 pin PLCC, according to

http://www.tivocommunity.com/tivo-v...&threadid=93312

Posted by: ElectricLegs

The main difference between the 37 and 39 proms is that the 37 isn't the new "low voltage" onboard flashable type. Same pinout and even the Atmel 49lv001 should work here also. The SST chips require a cap be used while flashing that many 32plcc adapters don't have. You can mod one easily though.

I've got my S2 prom socketed but haven't had time to mess with reflashing/testing kernal mods yet.

Posted by: Sirwill

Well I've done some research and it looks like what I will need to do for those with a 37 is read the 37, make the mods, and then program it on to a 39. Then solder the 39 in place of the 37. The pin outs are completely the same so it should be an exact swap. My labtool rom burner has the profile necessary to flash the 39, but not the 37. But the 37 should be able to be read with the 39 settings. (because of the exact pin being the same.)

So the next question is... is there anything different stuffed on the system board for the 39 vs the 37 to support future onboard flashes?

Anyhow I'm moving in a week, when I get moved (about 2 weeks). I will order some samples of the 39 chip, then I will need one or two people willing to let me test it on their unit.

Posted by: Combat Medic

On the assumitation that you will be able to re-flash it back to the factory code, I'm in on the beta test.

-Mike

Posted by: Sirwill

quote:
Originally posted by Combat Medic
On the assumitation that you will be able to re-flash it back to the factory code, I'm in on the beta test.

-Mike

Well, The plan is to read the current chip, and only modify the code on a new chip. So the original chip will be a backup of the original code.

And Of course it would be tested before being sent back out.

Will

Posted by: mstroh

quote:
Originally posted by Sirwill
Well, The plan is to read the current chip, and only modify the code on a new chip. So the original chip will be a backup of the original code.

And Of course it would be tested before being sent back out.

Will

Any progress?

-mike

Posted by: ElectricLegs

A bootable modded prom is done. If you can modify the kernal/initrd then email me for more info...

Follow this thread for updates.

http://www.tivocommunity.com/tivo-v...&threadid=97352