Series2 in PAL

[Skolink]

I've got friends who work at a company with an NDA with Broadcom, but they couldn't persuade the appropriate person to provide any info. I'm always on the lookout for some one else..
I've just imported a Series 2 DT. The first step was converting the PSU to 230V, now I need the PAL version of the NTSC Samsung tuners, and also the registry settings for the BC chips (different again from those on the standard Series 2).

Series 2 seem to be more plentiful on Ebay now than Series 1.

The info will come out sooner or later. In the mean time I'm trying to source some tuners (not the same as in the Series 1).
Cheers,
John

[example3891]

As somebody who has access to the information you need this is heartwrenching for me to stand by and watch this go on. Unfortunately due to fear of losing my career I can't say anything. I can tell you that what you are trying to do is very possible but it's not going to be easy.

I know this comment has been no help but I wish you the best of luck I would really like to see you guys succeed on this. It's such a shame that it's come down to this.

[petestrash]

As somebody who has access to the information you need this is heartwrenching for me to stand by and watch this go on.

While writing your post, It's probably at this point you should have realised your post would not be helpful, and really just cause more frustration.

Over the years we have many people claim to have the information, and choose not to share it. Personally my feeling is that these people do not know anything and just post to be mean/stupid. If they really had any knowledge and chose not to share it, why bother posting?

We do know that it's possible, and it's just a matter of finding the correct addresses.

It's a shame the NDA still applies to what really is a superseded product.

I thought that by now that someone would have contacted one of us privately and anonymously to provide the snippets we require. This information is generic and there is no way it could be traced back to the individual providing it. Not to mention the bits we are after are not commercially sensitive, as you would need to be using the Broadcom chips to make use of it.

Peter.

[Darren King]

Hear Hear Peter.

I was going to type a message similar to yours this morning but thought I would hold off as it sounded too harsh. But on second thoughts; stuff it. I wholeheartedly agree with all you have said.

For someone to post (and example3891 don't flatter yourself you are by no means the first) saying "hey I have the information but you can't have it" serves no purpose but to anger the OzTiVo community as it flies directly in the face of our open "share and prosper" stance. There's many a way to get the information to us anonymously without putting anyone's job in jeopardy if a little thought was put into it. For well over three years I have had such an open invitation sitting on my website. Like Peter, I feel that unless you choose to prove you know anything then you are just blowing hot air and nothing more.

I'll bet my bottom dollar that even though "example3891" sits there saying he can give us the information but choose not to he will be one of the first to use the hack when it becomes available.

[inaxeon]

I've got friends who work at a company with an NDA with Broadcom, but they couldn't persuade the appropriate person to provide any info. I'm always on the lookout for some one else..
I've just imported a Series 2 DT. The first step was converting the PSU to 230V, now I need the PAL version of the NTSC Samsung tuners, and also the registry settings for the BC chips (different again from those on the standard Series 2).

Series 2 seem to be more plentiful on Ebay now than Series 1.

The info will come out sooner or later. In the mean time I'm trying to source some tuners (not the same as in the Series 1).
Cheers,
John

I presume you're talking about my former employer (who doesn't need to be named here). There's only a select few there who have the ability to download arbitrary documents. Even if one of those people is your contact I'm still not sure if they'd help you. Broadcom's docSAFE system is extremely clever as it automatically watermarks, passwords and re-words each download of a document making it unique to the person who downloaded it. When you take that and think about leaking information that's kinda scary for the individual involved as you are personally accountable for that information. Generally one hangs onto copies of datasheets and doesn't let them out of their sight.

So now our only hope is down to someone having access also being a hardcore TiVo hacker (unlikely) as they would have to distill the needed information into a hack themselves as just "passing on" large chunks information to another hacker would be too risky as you don't know where it's going to end up and some of that may have been unique to your copy of the document.

So by some miracle the above two circumstances have occurred and the S2 is now hacked - S2's are flying out of the country for use in situations that don't profit TiVo. I can imagine an instant political ****storm between TiVo and Broadcom. Broadcom would launch an instant investigation as to how this information "got out". The first thing they'd do is check who downloaded that document recently (you'd probably be the only download in 2 years as the chip is mostly used by TiVo) A little further amateur forensics and you're busted.

You try being a TiVo enthusiast working in that area - it freaking sucks. Probably ten times more frustrating than being the person trying to hack it.

I know that like the post of "example3891" my post has once again been negative and unhelpful but this is the situation many people themselves in thanks to corporate greed and vicious guarding of intellectual property. Some day someone's going to have to do something extremely brave and just throw it out there. (Maybe someone terminally Ill who works for a company that's about to go bankrupt. Now we're talking :-)

[Darren King]

I know that like the post of "example3891" my post has once again been negative and unhelpful

On the contrary. It gives insight into what protection Broadcom has against such information leaking out. Hey, props to them. If you have trade secrets and are bound to secrecy by TiVo, inc then that is what they have to do. You've done quite a good job explaining rather than everyone else (and I mean everyone) who has "claimed" to know something but never produces any evidence.

Being the constructive thinker I am however it would not need the *whole* document passed onto anyone, although I can vouch for a particular name (note name as in singular) that to most here would just be "anybody" but to me is the direct person who would write the PAL module and also be a 100% secure "do not hand out this information" person. Even to that end all that would be required is the particular register(s) that need programming and nothing more. I've seen literally thousands of technical documents on chips and the table would not be something "re-written" by any document security system otherwise the chip wouldn't work as it should, would it? I'm sure other issues raised like watermarks and passwords can be circumvented simply by hand copying (as in hand writing) the relevant registers. While I am not expecting anyone within Broadcom to go off today and access the system and then hand it over tomorrow thus giving a direct lead to find out who provided the information I also highly doubt that the only copy of the relevant document in existence is locked away on a protected server. Someone, somewhere, must have the file on a local PC or a hardcopy that is gathering dust that was downloaded and/or printed YEARS ago that combined with manually copying down the relevant information would make the job of traceability almost impossible.

And besides, like Peter has mentioned, I highly doubt that TiVo would be that interested in pursuing how the information got out. We're not talking about a product that is being highly marketed anymore (they now have a Series 3) nor are we talking about the information being used to create a competing product. We're talking about utilising what is now relatively old hardware (it can't even do high def!) that a lot of units are now turning up on eBay as surplus or ending up in the trash if they are broken. In effect what is fast becoming (if not already) obsolete technology. If TiVo had a real problem with what OzTiVo is doing with their hardware they would have shut us down years ago. Why? Because even the Series 1 has the words "Private And Confidential" screen printed on the motherboard near the diagnostics connector. That never stopped people devising aftermarket add-on hardware, freely distributing hardware information on the units (of which even I am guilty of) or reverse engineering how the guide data works. All of which TiVo knows about and the only stipulation that I know of is TiVo expressly saying that it is for non-profit hobbyist use in areas a TiVo service is not provided. And at any rate like mentioned by the original poster the BCM7040 and BCM7020 is *not* a TiVo-Broadcom proprietary chipset. It has been used in other devices.

Take all of the above as you will. My intentions are not to argue or pressure anyone to do anything but merely looking at it from what is probably a very simplistic viewpoint.

Anyway, the offer still stands as it has done for years: If anyone has anything they wish to share on the information required then feel free to contact me anonymously and I'll 100% ensure your anonymity.

[inaxeon]

Perhaps you should mention how one may contact you anonymously because there may just be someone who has the right information reading this thread as we speak.

Here's another interesting thought for you - I've seen one silicon vendor (not Broadcom) have many many copies of the same registers, only disclosing the location of one set to each customer. That might sound extreme, but it really helps track down leaks :-)

Another thing I've found when working with these chips is that the vendor doesn't always give out the datasheets "Willy Nilly" usually all we get is a precompiled library with an easy to use API for performing the needed tasks on the chip and if there's any issues with that API the vendor will support that rather than giving out a register reference to fix it yourself. (Which does make me wonder, has TiVo been lazy and just used one of these libraries?) So it's not always as straight forward as getting register reference datasheets.

[Darren King]

Perhaps you should mention how one may contact you anonymously because there may just be someone who has the right information reading this thread as we speak.

My website (link is in each and every post I make in my signature) contains my email address. I am sure if one genuinely wanted to help they can find a public terminal, obtain an email address, and email me. From there I am happy to give out better ways of contacting myself. I used to publish my mobile (cell) phone number but although people could read the numbers to dial the correct number they could not read the correct numbers for the times you can and cannot contact me so I withdrew it. I do have a family and a real job so getting calls all hours into the evening is not the done thing.

Failing that one can always send me a private message on this forum.

I'm sure there are other ways people can contact me. I'm not a very private person and just reading my website can give a few more clues if one is genuinely interested in helping the cause.

Another thing I've found when working with these chips is that the vendor doesn't always give out the datasheets "Willy Nilly" usually all we get is a precompiled library with an easy to use API for performing the needed tasks on the chip and if there's any issues with that API the vendor will support that rather than giving out a register reference to fix it yourself. (Which does make me wonder, has TiVo been lazy and just used one of these libraries?) So it's not always as straight forward as getting register reference datasheets.

True. However I am assuming that there is more than simply a subset of registers or an API in the possession of "example3891" (and others) given the wording "As somebody who has access to the information you need".

However I could be wrong. Like I have said previously I've seen zero evidence of anything so therefore until someone wants to step up to the plate anyone could be telling OzTiVo any old story, including yourself with what you have already divulged about how Broadcom conducts their document control.

Cheers

[inaxeon]

However I could be wrong. Like I have said previously I've seen zero evidence of anything so therefore until someone wants to step up to the plate anyone could be telling OzTiVo any old story, including yourself with what you have already divulged about how Broadcom conducts their document control.
Cheers

That is true. I could just be making all of this up and there's no point in me trying to back up anything I've said because I don't have any useful information to start with. We'll never know until someone divulges anything useful.

[Islander]

And at any rate like mentioned by the original poster the BCM7040 and BCM7020 is *not* a TiVo-Broadcom proprietary chipset. It has been used in other devices.

Interesting reading.

I wonder if TiVo is not the only product using these devices then what are the other ones and could they provide some sort of insight into the problem.