Log of exploring the Scientific Atlanta DVR 8000 Unit
INTRO
In our cable area we have TimeWarner. Recently (April, 2003) the cable
company released a DVR ability. You can order this unit for an extra $10
a month (if you already have digital cable). But since this isn't a
Tivo or ReplayTV we wanted to know more about it. There wasn't much
out on the internet yet about this so we decided to document our research
here. Anyway, hope this helps anybody who is curious about this unit.
Documents and Tech Sheets about the Explorer 8000
Explorer 8000 Tech Sheet DataSheet (3 pages)
Explorer 8000 Remote Control Tech Sheet
Developers Guide (72 Pages)
DBDS System Overview (35 Pages)
DBDS API (86 Pages)
PowerKey System Overview (7 Page)
Business Operating Support System (124 Pages)
Business Applications Support System (65 Pages)
PowerTV OS Overview (441 Pages)
PowerTV Application Development API (1,112 Pages)
This is the information I get when going to console status menu about my device:
(Passport>Echo) 1.0.069
OS - PowerTV 6.0.7sp(5)
Fwd Lvl: 119Mhz2dbmV Rev Lvl: 11Mhz33dbmV
This menu can be accessed when you first turn your device on. (TODO: List steps)
On the back there is a sticker. On it appears to be a MAC address so it may be good to jot that down.
The unit itself is sealed with basic security hex screws. You can get bits from JackStuff.com If you don't already have some.
DATASHEET
| Reverse Path DAVIC Data Transmitter |
- Two-way IP communication between set-top and headend
- Supports Web Browsing and Email
- Transmition speeds up to 1.544 Mbps
|
| MPEG-2 MP@ML |
Standard MPEG Decompression
|
| 80 Gig Drive |
50 Hours Recording Time |
| DUAL Tuners and MPEG Encoders |
Allows recording of two things at once |
| 32-Bit RISC Processor |
2 164 MHz Processors |
| PowerTV OS |
Remotely Upgradable OS |
| 8 MB Flash |
Stores OS and resident Applications |
| 16 MB DRAM |
Stores Applications |
| 8 MB DRAM |
For MPEG Decoding Graphics |
| 16 MB DRAM |
For MPEG Encoding |
| 8 KB non-volatile memory |
Stores user settings |
| PowerKey Access System |
Handles RSA Key pairs |
| Internal Security Microprocessor and Smart Card Slot |
Hardware assisted conditional access method |
| Macrovision Support |
Supports MSO restrictions |
| USB Port |
For connecting input devices (Keyboards, Mice, Digital Cameras, etc) |
| Dual IEEE 1394 Interface |
Supports 400 Mbps interconnection to devices such as HDTV, hard disks, camcorders, etc |
Images
Inside of the Explorer 8000
The Hardrive unit
The Hardrive Unit attached to a Linux Box
Steps I took
I know that TimeWarner will disable the unit if it is unplugged for a prolonged
period of time. So, what I came up with was a simple method to boot the
drive glean some information off of it at bootup then burn the drive to a
CD-ROM so I could peruse the data while watching movies on the DVR ;)
Bootup
I booted my local desktop linux box with the drive attached. This device
would register as hdc. Here are the steps and commands I entered:
dmesg | grep -i hdc
ide1: BM-DMA at 0xfc08-0xfc0f, BIOS settings: hdc:DMA, hdd:pio
hdc: Maxtor 4R080L0, ATA DISK drive
hdc: 160086528 sectors (81964 MB) w/2048KiB Cache, CHS=9964/255/63, UDMA(33)
fdisk -l /dev/hdc
Disk /dev/hdc: 81.9 GB, 81964302336 bytes
255 heads, 63 sectors/track, 9964 cylinders
Units = cylinders of 16065 * 512 = 8225280 bytes
Disk /dev/hdc doesn't contain a valid partition table
xxd /dev/hdc | head
0000000: 0000 0000 0000 0000 0000 0000 0000 0000 ................
0000010: 0000 0000 0000 0000 0000 0000 0000 0000 ................
0000020: 3412 7856 0000 0004 0000 0a00 1000 0000 4.xV............
0000030: 0e00 7b82 0100 857d 12fa 13de e54f 7b6a ..{....}.....O{j
0000040: 1000 0000 0000 0100 0000 0100 65b1 2cf1 ............e.,.
0000050: 0000 0000 0000 0000 0000 0000 0000 0000 ................
0000060: 0000 0000 0000 0000 a4d4 731e 0000 0100 ..........s.....
0000070: 0040 0000 0000 0000 0000 0000 0000 0000 .@..............
0000080: 0000 0000 0000 0000 0000 0000 0000 0000 ................
0000090: 0000 0000 0000 0000 0000 0000 0000 0000 ................
It appears that the device is being used as a raw device. And no
real obvious signs as to what filesystem is being used altho I suspect
it is a proprietary one like Broadband File System (BFS). Don't forget
that we can't just leave this unplugged all day. Grab a CD sized chunk
of the drive with this command:
dd if=/dev/hdc of=dvr.img bs=1M count=650
Then burn it to CD w/ your favorite burner so you can share it amongst your
friends :) I used K3B to burn mine. Now screw the lid back on and plug
the unit back in before time warner notices it was offline.
The Data Analysis
Fist thing I did was run strings against it. I saw several English like
strings but something was up and it took me a second to notice what.
Example String: iTemt onitiD RVd irevsr :53s cenosd
This was too close to a sentence to be a coincidence. So I stared at it
for a few seconds and realized that every other letter was inveresed.
iT becomes Ti, em becomes me, etc. So the
above line translates to:
Translated line: Time to init DVR drivers: 35 seconds
I imagine this is because the actual unit has a RISC processor and perhaps
this is a high order bit issue. Any way this line appears to come from a
log file of some sort. The real interesting thing is when you decode a large
chunk around this line you get:
04/15/03 13:54:28 avfs_InitSoftThrd : Time to init DVR drivers: 35 seconds
04/15/03 14:31:33 Unit:0 Time: 45803 Unc: 11389 D:00 F:00, 0h AVDiscs: 00 MaxW: 10 LastW: 0 DmaDisc:00 C: 0 E: 0
01/01/96 00:00:13 avfs_InitSoftThrd : Time to init DVR drivers: 4 seconds
01/01/96 00:00:12 avfs_InitSoftThrd : Time to init DVR drivers: 3 seconds
05/10/03 11:23:07 avfs_InitSoftThrd : Time to init DVR drivers: 4 seconds
05/10/03 11:58:55 Unit:0 Time: 59794 Unc: 993 D:00 F:00, 0h AVDiscs: 00 MaxW: 16 LastW: 2 DmaDisc:00 C: 0 E: 0
05/10/03 12:29:32 Unit:0 Time: 59821 Unc: 1264 D:00 F:00, 0h AVDiscs: 00 MaxW: D LastW: 2 DmaDisc:00 C: 0 E: 0
05/10/03 12:37:26 Unit:0 Time: 59877 Unc: 1264 D:00 F:00, 0h AVDiscs: 00 MaxW: B LastW: 2 DmaDisc:00 C: 0 E: 0
05/10/03 12:37:31 Unit:0 Time: 0 Unc: 1264 D:00 F:00, 0h AVDiscs: 00 MaxW: 0 LastW: 0 DmaDisc:00 C:
Now I got my DVR around 5/15. Interesting...
By now you've probably realized that I didn't decode this by hand. I wrote a
small little C program to do this for me. It is available
here. I then took a small chunk (50 Megs) and
transposed the entire thing. Wow did that make strings output much nicer :)
There are lots of logs and what not. So the next section I release will
probably be conclusions and tools. It may be useful to note that PowerTV
may be based on
AvSYS based on some of they system files present.
It would be really nice to have the header files for avsys's filesystem but
alas, I don't currently have them. And my research thus far has ended. I
will be willing to post anything new that people find. Here is a log
extracter for the DVR unit.
Extractlogs.pl - Extracts a week worth of logs
and the system log. Data needs to be run through transcode first.