Maky your DirecTivo BOOT Faaaster!!

[BubbaJ]

OK as we all know, the Directivo boots rather slow. While methodically plodding through the rom (made easier with the help from a Ms. A. Mous) I have come to the conclusion that the DirecTivo can be made to boot somewhat faster by skipping over certain unneeded sections of its boot code.

NOTE: I work with DWORDs (4 byte chunks) which is what the PPC works with

Change 1:
Offset (from beginning of prom)
0x1457C
Current Value
4b ff fc 39 (this is a jump to a BIG calculation on the kernel)
New Value
48 00 00 64 (a different kind of jump to somewhere that says everything is OK)


Change 2:
Offset
0x1F414
Current Value
7c 83 23 78 (it's setting up to calculate something stupid, a big hash on a little block of data)
New Value
48 00 00 70 (a jump to the next step after the hash)


after changing these 8 bytes, your DirecTivo should boot faster (somewhat).

I have been told that this also allows the use of a kernel that is altered in some manner or missing its initrd, I have not yet verified these claims personally. I can verify that it speeds up the boot process ( a little)

I used getprom from the 2.5 root partition (thanks chipster) and used the command 'getprom -Update prom.bin' it flashed the prom, then complained about the checksum being invalid. I then went and searched the rom for the checksum it said SHOULD be there, it's at 0x1FC, and replaced it with what it said it calculated. I have been informed however that this checksum does not matter. (it never gets checked)

in any event, if someone has a kernel that they have set up in anticipation of such a move, please test it and make it available.

Thanks,
BubbaJ

[kspades]

Hey, what did you use to actually edit the prom? Can I just open it up in a regular Hex editor and mess with it like I do my core in BasicH?

[Neutronflux]

In terms of hacking the 2.5 software... is this the answer we need???

LET GET CRACKING!!!

Neutron

[kspades]

Please ignore the newbie!

[Neutronflux]

Hey Kspades... thanks for the newbie comment... just for the record, changing your guide byte in Hex using Basic H isn't all that hard... I've been doing some reading regarding BubbaJ's posts and this prom editing looks promising.

I still don't see how you can modify the prom without having to take it out and flash it.

*Sigh* some people have no patience,

Neutron

[BubbaJ]

OkeyDokey

1) get a 2.5 root partition, Yes, you need this..

2) get the file /prom/TiVoProm_2.05.bin from said partition

3) edit the file, yes in a hex editor, (though you could do it in a binary editor if you really wanted to, or a .bmp editor if you've got guts/balls/an intimate knowledge of 2d/color coordination. I use Axe from kahei.com, it's broken but it edits files great..

4) this step is IMPORTANT!! put the file on the tivo, I renamed it to prom.bin, and put it in /var (I use rz/sz, you can used whatever makes you happy)

5) use the command (on the tivo now) getprom -Update prom.bin
note the "U" in "Update"

6) reboot

note: if your tivo doesn't come up with a screen that says welcome powering up, you've done something wrong. Likewise if it never leaves that screen. If it comes up with a tux image, send me a copy or tell me where/how to insert my own image..

..

If you use a bitmap editor in step 4, let me know, and I'll put up a webpage somewhere in your honor..

[kspades]

Great!
However I am concerned about recovery procedures. Say if you do screw up and never get past Powering up.... screen, what then? How do you recover your original prom since at this point there is no way to actually attain bash on the tivo?

[IWantMyDTV]

That is, until someone comes up with the correct method to attach a JTAG header to the TiVo and the correct program to burn the prom. The only other option involves a bit of desoldering, and a prom burner of the correct dimensions.

[BubbaJ]

yeah, what (s)he/it said..

really though, if you don't make any mistakes and the power doesn't go out or anything and you make sure that what I say should be there is there before you change it, you should be OK.. that being said, if something happens, TFB.. I did this on MY dTivo, I know that it works as far as being able to boot the 2.01 stuff that was there and I know that it is updated because it tells me so when I ask it. Danger has been in this game from the beginning, and while it is (always) possible to recover, there may be some people who are unwilling to take the risk. If you aren't willing to take the risk, pay someone to take it for you..

[kspades]

I'm officially in the fixup tivo business $75 and your tivo...all I need is a 2 day turn around time.

[chipster]

Great job BubbaJ! I bow to you...

And I don't mind living dangerously...

It works! On to the kernel...

[IWantMyDTV]

So what is the easiest way to boot 2.0x on a 2.5 TiVo to burn the prom?

[BubbaJ]

figure out which partition you boot from, replace it's kernel with 2.01 and replace it's root with a hacked 2.01, that will allow you to boot to 2.01 which will allow you to update the PROM which will allow you to put in a semi-whacked Kernel, which will allow you to boot from your own initrd or just boot from the root partition.

[IWantMyDTV]

So, then the most simple way of burning the prom would be:
[list=1][*]backup your 2.5 drive[*]restore 2.0x (I am assuming 2.01 or 2.00 would be fine)[*]copy over the prom and getprom (I have heard that only v2.5 getprom can burn a 2.5 prom)[*]have the tivo create a shell in the startup script[*]boot the tivo[*]use the shell to burn the prom[*]restore the 2.5 backup[*]replace 2.5 kernel with hacked kernel[*]enjoy[/list=1]

[newlooper]

I am having trouble with the update. I keep getting "bad reset vector" I am guessing I have a bad checksum on my file. How should I calculate 8 bit 16 bit 32 bit

Thanks