Terminal output op de UPC MediaBox via scart.

Allen,

Wellicht is dit wel een deuropening naar meer info over de UPC Mediabox.
Bij toeval ben ik er achter gekomen dat bij sommige apparaten met een scart aansluiting, dat je op pen 10,12,14 (data 1, data 2, data ground) data kunt uitlezen met een terminal programma in combinatie met een max232 converter ertussen (ivm spannings niveau).
Ook dit geldt voor de UPC MediaBox.
Baudrate: 19200
Data Bits: 8
Parity: None
Stop Bits: 1
Flow Control: None

Onderstaande log krijg je als je de communicatie tot stand brengt en de MediaBox voorziet van Power:

%%LD : #################### LAUNCHER ####################

%%LD : Main board serial number : **********

%%LD : Launcher release number : 3.10

%%LD : Loader release number : 3.10

%%LD : Decoder IDs :

%%LD :
OUI : 0x00-0x10-0x95

%%LD :
hwUsageId : 0x00

%%LD :
swUsageId : 0x00

%%LD :
versionId : 0x0040

%%LD :
PT : 0x0820

%%LD :
PV : 0x0002

%%LD :
PR : 0x0010

%%LD :
flagSerialDownload = ON (0x01)

%%LD :
flagInterruptible = OFF (0x00)

%%LD : MAC decoder address : **:**:**:**:**:**

%%LD : Nominal download triggered

%%LD : --------------------- LOADER ---------------------

%%LD : UPC_EUROPE_DCI5000

%%LD : @(#)Loader - Copyrights THOMSON R&D France - Version 3.10

%%LD : Apr 20 2005 - 14:19:52

%%LD :
Download flag : 0x00000002 (RECOVERY DLD)

%%LD : Searching software update stream location ...

%%LD : Trying frontend set n°0 pid 0x1301

%%LD : Frequency = 164 MHz

%%LD : Symbol rate = 6900 KHz

%%LD : Modulation type = 3

%%LD : Carrier detected

%%LD : Trying section acquisition on PID : 0x1301

%%LD : Signal cut

˜æ

#APPSTOR DUMP >>>
#APPSTOR <<< DUMP

#SECURE:WARNING: / is not permanent
gdbo raw port not initialized

%% ID : Detected 5100 CUT2.0
#INTPRT[RESET] starting
[o_xyman_client_register] success: client = ********.
#INTPRT[RESET] init
%%GSQC : project = @(#)UPC_EUROPE_DCI52_00

%%GSQC : priv. ver = @(#)DCI5xUPC_SW1_93

%%GSQC : glob ID = 0x0000

%%GSQC : MIN = DCI52UPC

%%GSQC : MA = Not Applicable

%%GSQC : DRV = @(#)DCI52UPC_DRV_SW_R1_61

%%GSQC : osal = @(#)v1.5.8-2

%%GSQC : st20 = DCU_2.0.5_PATCH_2

%%GSQC : CA = @(#)ca_UPC_E_DCI52UPC_rel1_4

%%GSQC : optv = @(#)
OpenTV EN23122

%%GSQC : serial nb = ************

%%GSQC : SW ver. = 1.93

%%GSQC : manuf ver = 52UPC01

%%GSQC : pti = 0x00030803

%%GSQC : tc = 0x00030803

%%GSQC : ret boot ver = 03.10.03.10

%%GSQC : ret SW ver = 1.93

[UCNP] RAM available = 8583816
[UCNP] Max segment
[UCNP] Manufacturer = THOMSON, OUID=
[UCNP] 52UPC01
[UCNP] 1.93
[UCNP] EN23122
[UCNP] 1.1.19
[UCNP] 03.10.03.10
Socket pair created : first = 1 and second = 2.
%% GINIT : decoder_hard_init_3

%%GSQC : OUI = 0x00 0x10 0x95

%%GSQC : UID = 0x00

%%GSQC : PT/PV = 0x08200002

%%GSQC : PR = 0x0010

%%GSQC : VID = 0x0040

%% GINIT : >>>>>> CASS INIT DONE <<<<<<
[TCP-IP_LINK] DNS Server IP addr reset OK !
[TCP-IP_LINK] o_link_open returned OK
[o_xyman_client_register] success: client = ********.
#INTPRT[RUNNING] running:0x2
[UCNP] CA msg received ALARM, 105
[TCP-IP_LINK] link notify => O_LINK_EVENT_LINKUP with cond 0
[TCP-IP_LINK] Following info retrieved from DOCSIS_SCM_QRY_NAME Sq&C :
[TCP-IP_LINK] STB IP Address ***.***.***.***
[TCP-IP_LINK] DHCP Addr ***.***.***.***
[TCP-IP_LINK] net mask ***.***.***.***
[TCP-IP_LINK] lease time 568295 seconds
[TCP-IP_LINK] Host name
[TCP-IP_LINK] Domain name chello.nl
[TCP-IP_LINK] Router Addr ***.***.***.***
[TCP-IP_LINK] Following DNS info retrieved from DHCP answer :
[TCP-IP_LINK] DNS server1 ***.***.***.***
[TCP-IP_LINK] DNS server2 ***.***.***.***
[TCP-IP_LINK] DNS data updated !!
[UCNP] CA msg received ALARM, 102
[UCNP] CA msg received NOTIFICATION, 104
[UCNP] CA msg received NOTIFICATION, 100
[UCNP] CA msg received NOTIFICATION, 103
[UCNP] CA msg received NOTIFICATION, 102
[UCNP] CA msg received NOTIFICATION, 101
-------------- nb link = 1 ,name = generic_gnplink
CASS_RPH => The return path link is now open.

Serienummer/macadres/ipadres heb ik vervangen voor ******


Data voor Nederland 1

[UCNP] Channel: 1, 62465, 0
[UCNP] Channel component: VIDEO_T
[UCNP] Channel component: AUDIO_T
[UCNP] Channel component: TELETEXT_T


Data voor Reality

[UCNP] Channel: 19, 62465, 18
[UCNP] Channel component: VIDEO_T
[UCNP] Channel component: AUDIO_T
[UCNP] Channel component: TELETEXT_T
[UCNP] Channel component: DVBST_T
[UCNP] Channel component: DVBST_T
[UCNP] Channel component: DVBST_T
[UCNP] Channel component: DVBST_T
[UCNP] Channel component: DVBST_T
[UCNP] Channel component: DVBST_T
[UCNP] Channel component: DVBST_T
[UCNP] Channel component: DVBST_T
[DVBST] DSS: Access granted: comp_page = 2 anci_page = 2


Data voor Canal+ (geen abonnement)

[UCNP] Channel: 102, 62465, 23
[UCNP] Channel component: VIDEO_T
[UCNP] Channel component: AUDIO_T
[UCNP] Channel component: TELETEXT_T
[UCNP] CA msg received NOTIFICATION, 106


Data voor het indrukken van de "Guide"

#APPSTOR: appstore_verify_application
#APPSTOR: checking app flags
#APPSTOR: checking module flags
#INTPRT[RUNNING] exited, status:0x1
#INTPRT[CLEANING_UP] init
#INTPRT[LOADING] in progress
#INTPRT[LOADING] module
#INTPRT[LOADING] module
#INTPRT[LOADING] module
#INTPRT[RUNNING] running:0xffffffff
good trackswitch call
track_process_control_msg
MSG_TYPE_STATION_CONTROL:STREAM OFF: OPENTV, HANDLE 0x0, TRACK (0x00000000) 0x44 0x41 0x59 0x30
checking message_control_cond for C_STREAM_ON
unknown condition!
msgUsed is 1
#APPSTOR: appstore_verify_application
#APPSTOR: checking app flags
#APPSTOR: checking module flags
#APPSTOR: calling am_storing_request
track_process_control_msg
MSG_TYPE_STATION_CONTROL:STREAM ON: OPENTV, HANDLE 0x0, TRACK (0x44415930) 0x44 0x41 0x59 0x30
checking message_control_cond for C_STREAM_ON
message_control_cond C_STREAM_ON track 44415930
track_current_tag MATCH!
msgUsed is 1


Data voor de interactieve zender 3voor12

[UCNP] Channel: 614, 62465, 72
[UCNP] Channel component: VIDEO_T
[UCNP] Channel component: AUDIO_T
[UCNP] Channel component: MODULE_T
[UCNP] Channel component: MODULE_T
[UCNP] Channel component: VIDEO_T
[UCNP] Channel component: AUDIO_T
[UCNP] Channel component: MODULE_T
[UCNP] Channel component: MODULE_T
[UCNP] CA msg received NOTIFICATION, 106
#APPSTOR: appstore_verify_application
#APPSTOR: checking app flags
#APPSTOR: checking module flags
#INTPRT[RUNNING] exited, status:0x1
#INTPRT[CLEANING_UP] init
#INTPRT[LOADING] in progress
#INTPRT[RUNNING] running:0xffffffff

### --- Application Information --- ###
ApplicationId: CB4E0891-2DA3-4830-AA8-70B1CF5BD8F7
Time of compilation: 06 July 2006, 49:21:09
PMC version: 4.2.1.20
ETV-studio version: 4.2.1
Template version: 4.1.0.3
Application version: 2
### ------------------------------- ###

.1__STREAM_OFF; __ (track: 0, tuning req: 0, restore loaders: 1) __STREAM_OFF; switching to secondary PID 0x5345434f!!Station

control condition: 8; type: 79 Got a quit event. (reason: 4)Quiting....!#INTPRT[RUNNING] exited, status:0x1
#INTPRT[CLEANING_UP] init
#INTPRT[RUNNING] running:0x2
[UCNP] Channel component: VIDEO_T
[UCNP] Channel component: AUDIO_T
[UCNP] Channel: 612, 62465, 71
[UCNP] Channel component: VIDEO_T
[UCNP] Channel component: AUDIO_T
[UCNP] Channel component: VIDEO_T
[UCNP] Channel component: AUDIO_T
[UCNP] CA msg received NOTIFICATION, 106
[UCNP] Channel: 614, 62465, 72
[UCNP] CA msg received NOTIFICATION, 106
[UCNP] Channel component: VIDEO_T
[UCNP] Channel component: AUDIO_T
[UCNP] Channel component: MODULE_T
[UCNP] Channel component: MODULE_T
[UCNP] CA msg received NOTIFICATION, 106
#APPSTOR: appstore_verify_application
#APPSTOR: checking app flags
#APPSTOR: checking module flags
#INTPRT[RUNNING] exited, status:0x1
#INTPRT[CLEANING_UP] init
#INTPRT[LOADING] in progress
#INTPRT[RUNNING] running:0xffffffff

### --- Application Information --- ###
ApplicationId: CB4E0891-2DA3-4830-AA8-70B1CF5BD8F7
Time of compilation: 06 July 2006, 49:21:09
PMC version: 4.2.1.20
ETV-studio version: 4.2.1
Template version: 4.1.0.3
Application version: 2

### ------------------------------- ###

.1__STREAM_OFF; __ (track: 0, tuning req: 0, restore loaders: 1) __STREAM_OFF; switching to secondary PID 0x5345434f!!Station

control condition: 8; type: 79 Failed to open cookie !!!!!!!!!!!__STREAM_OFF; __ (track: 1397048143, tuning req: 0, restore

loaders: 0) Station control condition: 8; type: 79 Station control condition: 8; type: 86 Station control condition: 8; type:

65 Station control condition: 4; type: 0 __C_PROGRAM_ON (handle: 0x00000000) Station control condition: 5; type: 0 Station

control condition: 9; type: 86 Station control condition: 9; type: 65 #APPSTOR: appstore_verify_application
#APPSTOR: checking app flags
#APPSTOR: checking module flags
Station control condition: 9; type: 79 Got a quit event. (reason: 1)Quiting....!#INTPRT[RUNNING] exited, status:0x1
#INTPRT[CLEANING_UP] init
#INTPRT[LOADING] in progress
#INTPRT[RUNNING] running:0xffffffff

### --- Application Information --- ###
ApplicationId: EDC9C62A-3A15-4131-8DE7-94E2C429E864
Time of compilation: 06 July 2006, 11:14:09
PMC version: 4.2.1.20
ETV-studio version: 4.2.1
Template version: 3.6.0.4
Application version: 2
### ------------------------------- ###

.1__STREAM_OFF; __ (track: 0, tuning req: 0, restore loaders: 1) __STREAM_OFF; switching to secondary PID 0x5345434f!!Station

control condition: 8; type: 79 #APPSTOR: appstore_verify_application
#APPSTOR: checking app flags
#APPSTOR: checking module flags
.4.4a.5Station control condition: 9; type: 79 Station control condition: 8; type: 65 Station control condition: 9; type: 65

.r.T(-1).r.T(897).r.r.T(897).r.r.T(897).r.r.T(897).r.r.T(897).r.T(897).r.r.T(897).r.r.T(897).r.r.T(897).r.r.T(897).r.r.T(897)

.r.r.T(897).r.r.T(897).r.T(897).r.T(897).r.r.T(897).r.r.T(897).r.r.T(897).r.r.T(897).r.r.T(897).r.r.T(897).r.r.T(897).r.r.T(8

97).r.r.T(897).r.r.T(897).r.r.T(897).r.r.T(897).r.r.T(897).r.r.T(897).r.r.T(897).r.r.T(897).r.r.T(897).r.r.T(897).r.r.T(897).

r.r.T(897).r.r.T(897).r.r.T(897).r.r.T(897).r.r.T(897).r.r.T(897).r.r.T(897).r.r.T(897).r.r.T(897).r.r.T(897).r.r.T(897).r.r.

T(897).r.r.T(897).r.r.T(897).r.r.T(897).r.r.T(897).r.r.T(897).r.r.T(897).r.r.T(897).r.r.T(897).r.r.T(897).r.r.T(897).r.r.T(89

7).r.r.T(897).r.r.T(897).r.T(897).r.r.T(897).r.r.T(897).r.r.T(897).r.r.T(897).r.r.T(897).r.r.T(897).r.r.T(897).r.r.T(897).r.r

.T(897).r.r.T(897).r.r.T(897).r.r.T(897).r.r.T(897).r.r.T(897).r.r.T(897).r.r.T(897).r.r.T(897).r.r.T(897).r.r.T(897).r.r.T(8

97).r.r.T(897).r.r.T(897).r.r.T(897).r.r.T(897).r.r.T(897).r.r.T(897).r.r.T(897).r.r.T(897).r.r.T(897)Got a quit event.

(reason: 4)Quiting....!#INTPRT[RUNNING] exited, status:0x1
#INTPRT[CLEANING_UP] init
#INTPRT[RUNNING] running:0x2


En ga zo maar door, wellicht is dit slechts het begin.
Heb alleen geen idee of je het bootproces ook kan onderbreken (net zoals bij een aantal routers, tijdens het booten 3x op de

spatiebalk drukken).

ALs je de modem intern ontkoppeld, krijg je tijdens het booten ook nog de melding

[UCNP] CA msg received ALARM, 105


Misschien ligt hier wel de methode om de BoxID uit te lezen, zodat ook de DBOX-II gebruikt kan worden.


Ik zou zeggen, pruts mee en vermeld maar wat je ontdekt hebt.

Kijk, hier wordt ik nou vrolijk van . Dit scheelt me sowieso de aanschaf van een season interface om het verkeer te loggen en uit te zoeken hoe de communicatie tussen de decoder en smartcard verloopt. Nu ff flink wat verkeer loggen en de scripts voor Rom110 rev. A01 erbij leggen

Dit is idd vet en makkelijk voor toekomst ik ga er dan ook maar ff mee aan de slag maar dan met een pacebox

en weet je al meer

Kan iemand in één zin uitleggen wat we hier mee kunnen? Is het bijvoorbeeld mogelijk stiekem zenders te bekijken die eigenlijk zijn geblokt?

Het serie nummer is als het goed is het Box-id (naar hex omzetten)

Voor het serienummer hoef ik deze zooi niet te hebben kan ik zo aflezen.

Box id kan een ander nummer zijn.

Heb het geprobeerd, output lijkt wel chinees

henkjan99 zei:

Kan iemand in één zin uitleggen wat we hier mee kunnen?

Klik om te vergroten...

Met aan zekerheid grenzende waarschijnlijkheid: helemaal niks.

Ik weet niet of de oorspronkelijke ledendie dit begonen zijn, nog op dit forum actief zijn
Ook ik heb enige dingen gevonden die van belang kunnen zijn om deze boxen tekunen
begrijpen.
Aller eerst zit er op het printje waarook de RJ45 Etherhet aansl op zit,
waarschijnlik ook een RS232 port op TTL nivo.
5volt=High
0 volt =Low

De TDA8024 is de smartcard interface chip, dus tetappen.
De stx5100*- de micro controller MET Jtag zelfde als de 5518?
De Thomson STV6413D is een audio video matrix switch
De Broadcom , bekent van o.a. de SB5100, BCM3349 is de ethernet chip.


Being a bit bored with serial port 1, we decided to look further in the mediabox for more debugging capabilities. Our attention was caught by the cable modem card at the back. It's a Broadcom BCM3349 based cable modem. Googling for a bit yields quite some decent info. There are three pinheaders on the BCM3349 inside the mediabox. One of them is a 4-pin connector for the serial port. The other is a 5 pin connector for USB 1.1 (most probably, untested), and the last is a JTAG port (once again, based on assumption, untested)

After connecting the serial cable (115200/8/N/1/N), we drew some logs again:
====

De USB wordt herkent in mijn doos 0b69 hoewel ergeen chip inzit.

De updates geaccepteerd. Ook de eco shit