# For those of you that "want to know"..



## Wolffpack

Ok, As some of you may know, I've been doing some digging into the R15 just cuz I want to know. For those of you that are as curious as I am as to how things "might" work, the following is what I may or may not have found. 


It has been reported here and referenced over at DealDatabase.com that another user had performed a Unix "dd" copy of a drive from an R15 to a blank drive, inserted it into the R15 and it booted and ran without any noticed problems. I have tried the same and can verify this. I did not run into any problems with a new copy of the original drive in the R15. Maybe at least a backup method for those that don't want to loose their MYVOD. Keep in mind this does involved pulling the drive from your R15, placing it in a PC, booting a version of Linux and performing a dd copy.

I have been looking at the filesystem utilized by the R15 and it is tagged as a FAT32 partition. Mounting that partition on a Linux system works and one can browse through the drive seeing all files and directories. Appears to at least be FAT32 compatible.
The "files" under the root directory of the drive are few and most are coded as "system" files. They are as follows:​

Code:


-rwxr-xr-x   1 root     root      3130196 Mar 24  2034 jopa*
-rwxr-xr-x   1 root     root         1816 Feb 17 18:47 pcredit.dbf*
-rwxr-xr-x   1 root     root         4976 Mar 24  2034 pman.dbf*
-rwxr-xr-x   1 root     root       239202 Feb 17 16:25 signup.dbf*
-rwxr-xr-x   1 root     root        16104 Mar 24  2034 supp.dbf*
-rwxr-xr-x   1 root     root        52292 Mar 24  2034 xcatgry.dbf*
-rwxr-xr-x   1 root     root         4346 Mar 24  2034 xclient.dbf*
-rwxr-xr-x   1 root     root          532 Feb 18 15:51 xsetup.dbf*


As shows are recorded a set of files, associated with each show are stored in a directory under the root directory. So each show that you may have in your MYVOD equates to a directory under the root directory. This concerned me as to the known limitations with a FAT32 filesystems. The files within this directory are all named the same and the directory name is meaningless. For example:


Code:


12:
total 747776
-rwxr-xr-x   1 root     root         8928 Feb 18 00:00 meta_man.xm\001*
-rwxr-xr-x   1 root     root          705 Feb 18 00:00 meta_man.xmd*
-rwxr-xr-x   1 root     root        20170 Feb 18 00:00 meta_man.xmi*
-rwxr-xr-x   1 root     root        11993 Feb 18 00:00 meta_man.xmv*
-rwxr-xr-x   1 root     root            0 Feb 18 00:00 stream.ext*
-rwxr-xr-x   1 root     root     765591552 Feb 18 00:00 stream.str*

In this example the directory name is 12. As in c:12. From the file sizes the "stream.str*" would seem to contain the video stream.​
On the backup drive I created I tried the DOWN ARROW/RECORD method. The R15 did come back quickly with a drive minus all shows and SLs.
I'm working further on the filesystem as there can be no way DTV would have used a FAT32 filesystem for this product. I have some clues it may be more a FAT64 file system with compatibility backward to FAT32. Allowing file sizes > 4GB and partition sizes up to 2TB. Very interesting stuff.

But this is all just me being curious. If any of you are also curious, jump in. I would love to hear your observations.


----------



## Blurayfan

Thanks for the details. Maybe someone could now locate a way of increasing the partition size on the new drive giving the true upgrade we all are wanting.


----------



## Earl Bonovich

Wolffpack said:


> But this is all just me being curious. If any of you are also curious, jump in. I would love to hear your observations.


[jar jar]Me's just think you's gots to much time on your hands.... [/jar jar]

Just kidding...

It is intresting to see that.. I wish I had more time to tinker with it.

Did you or the DDB user, try DDing to a larger drive, and if so... did it take the new space into consideration?


----------



## Wolffpack

Using a "dd" copy is a bit by bit copy. In my test I copied the 160GB drive to a 250GB. But that was seen as a 160GB partition on a 250 GB drive. I did try the DOWN ARROW/REC operation however that left the 160GB partition as is.

To expand the partition size correctly one needs to alter the filesystem. I'm still working on that. FAT64 is the key. I may have even stumbled upon the vendor of the filesystem but I'm still working on that also.

Hey, for $25,000 I'll spend a little time on it.

Oh, BTW, not sure if anyone noticed but the Volume name on the drive is XTV_STR_DSK. Gee, wonder where that came from.


----------



## Clint Lamor

Would be interesting if you could move it to a larger driver and also are you able to look at the FAT table itself to see what it says about the drive?


----------



## Wolffpack

Kanyon71 said:


> Would be interesting if you could move it to a larger driver and also are you able to look at the FAT table itself to see what it says about the drive?


It's not a "legal" FAT32 filesystem as it shows 99% of the drive space being used. The two FATs do not show the same. It's most definetely an expanded FAT32, which at this point I'm calling FAT64. If I figure out any more, I'll post it.


----------



## Wolffpack

Oh, as an addon, has anyone pulled the cover on the R15 to know why it's so much more quite than the DTivos?


----------



## walters

Wolffpack said:


> I may have even stumbled upon the vendor of the filesystem but I'm still working on that also.


http://www.ebsembeddedsoftware.com/spotlight.htm

Of course, I'm really interested how they managed full backward compatibilty with FAT32 while at the same time breaking the 4GB barrier.


----------



## Earl Bonovich

Wolffpack said:


> Oh, as an addon, has anyone pulled the cover on the R15 to know why it's so much more quite than the DTivos?


When I pulled teh cover when I did the original review....

There was nothing "speciall" about what was going on in there (As in a building perspective)

My guess... the R15 is using the drive in a mannet that isn't causing the heads to go flying around (aka the noise we hear from a very active DTivo)


----------



## thumperr

This may sound dumb, cause it does not make full sense to me.

But why is the 4GB file size limit an issue. wouldn't the system just use pointers to link to the next file? Link chapters on a DVD. I can't remember the filesystem for the UTV, i think it was FAT32. but you can record for hours with it, i'd guess they used some type of pointer scenario to make this work.

The other features mentioned in the link for FAT64 would be nice.

I believe with the UTVs, that they used some new security feature in the hard drives at the time they came out. this was why some drives worked for the upgrade and some did not. as i recall you had to use WD drives at first. Maxtors would not work. It is possible that there is new drive feature that D* is using with this.

Would have been nice if D* had used the UTV approach. let the user swap the drive(simple task) and have it phone home and update. This way no need for someone to try and hack it for the upgrade. keeps people from poking around. this may not have been compatible with their lease plan.


----------



## Wolffpack

Earl Bonovich said:


> When I pulled teh cover when I did the original review....
> 
> There was nothing "speciall" about what was going on in there (As in a building perspective)
> 
> My guess... the R15 is using the drive in a mannet that isn't causing the heads to go flying around (aka the noise we hear from a very active DTivo)


Did you notice the rubber grommets on the drive mount? Almost every name brand PC case manufacturer that includes drive cages now include the rubber grommets. Amazing how quite a system is once the vibration from the HDD to the chassis is reduced via a tiny piece of rubber.

Kudos to DTV for taking this approach.

Well, plus they stopped using WD drives and went with Seagates.


----------



## Wolffpack

thumperr said:


> This may sound dumb, cause it does not make full sense to me.
> 
> But why is the 4GB file size limit an issue. wouldn't the system just use pointers to link to the next file? Link chapters on a DVD. I can't remember the filesystem for the UTV, i think it was FAT32. but you can record for hours with it, i'd guess they used some type of pointer scenario to make this work.
> 
> The other features mentioned in the link for FAT64 would be nice.
> 
> I believe with the UTVs, that they used some new security feature in the hard drives at the time they came out. this was why some drives worked for the upgrade and some did not. as i recall you had to use WD drives at first. Maxtors would not work. It is possible that there is new drive feature that D* is using with this.
> 
> Would have been nice if D* had used the UTV approach. let the user swap the drive(simple task) and have it phone home and update. This way no need for someone to try and hack it for the upgrade. keeps people from poking around. this may not have been compatible with their lease plan.


Linking multiple files would work, but seeing that they have exceeded the 4GB limit is encouraging as they are not using a stock FAT32 filesystem.

If they're using the one I think they are, it also include journaling, which must be required for an application such as this if it is ever to work.


----------



## ScottJ

So, a subfolder for each program in VOD?

That might explain why problems seem to increase as data on the machines increases.

FAT32 in a high I/O environment with many subfolders can be flakey IME.


----------



## walters

Wolffpack said:


> If they're using the one I think they are, it also include journaling, which must be required for an application such as this if it is ever to work.


Are you thinking of the one I linked above, or did you find another one?


----------



## cabanaboy1977

Wolffpack said:


> On the backup drive I created I tried the DOWN ARROW/RECORD method. The R15 did come back quickly with a drive minus all shows and SLs.


What does DOWN ARROW/RECORD method mean?

Wolffpack, I forgot do you only have one R15? I'm still wondering if you can swap HD between two R15's. That way you wouldn't lose shows/SL if you R15 died due to a non-HD issue. I hope you can. That was my biggest issue with the UTV's the tuner would die or the power supply and you lost all your shows and SL.


----------



## Earl Bonovich

DOWN ARROW/RECORD

Is the non GUI method to initiate a "Clear and Delete"

And to Cabanaboy....
I have two... and once I can get my hands on a 160 or larger drive, I will give it a shot....


----------



## Bobman

All this sounds nice but what does it really tell us non technical laymen ?


----------



## Wolffpack

walters said:


> Are you thinking of the one I linked above, or did you find another one?


Yep.


----------



## Wolffpack

Bobman said:


> All this sounds nice but what does it really tell us non technical laymen ?


Not much.  It really doesn't mean much for technocal folks either. Just in case anyone was interested.


----------



## cabanaboy1977

Earl Bonovich said:


> DOWN ARROW/RECORD
> 
> Is the non GUI method to initiate a "Clear and Delete"


Ok, I know what he's talking about now. I thought a linux command.



Earl Bonovich said:


> And to Cabanaboy....
> I have two... and once I can get my hands on a 160 or larger drive, I will give it a shot....


I would have tried it with my 3 but i'm afraid that it's going to marry with the drive like the UTV did and then I'll lose all the recordings. I don't want to lose my recordings. I wish I had thought about it before I started filling them up with SL. BTW if you want a cheap Samsung 160GB or 200GB drive, the mircocenter on odgen in westmont has them for ~$79-99.


----------



## Wolffpack

cabanaboy1977 said:


> What does DOWN ARROW/RECORD method mean?
> 
> Wolffpack, I forgot do you only have one R15? I'm still wondering if you can swap HD between two R15's. That way you wouldn't lose shows/SL if you R15 died due to a non-HD issue. I hope you can. That was my biggest issue with the UTV's the tuner would die or the power supply and you lost all your shows and SL.


I do only have one R15.


----------



## cabanaboy1977

Wolffpack said:


> I do only have one R15.


That's what I thought. Just double checking.


----------



## Wolffpack

Well, if there's a way to expand the R15 beyond 100 hrs of recording space, I sure can't find it. But as a recap, here's what I have found:

The R15 will repartition and correctly format a larger drive. I've tested a 250GB drive successfully, a 300GB drive is repartitioned and formatted correctly but once that has been completed the R15 will not boot with the 300GB drive installed. Also, many of my partition utilities noticed differences between the 250GB FAT32ish partition that works and the 300GB FAT32ish partition that doesn't work, even though the R15 did all the work. To me this indicates a 300GB drive may not work with the current filesystem used by the R15.

So, we can install a larger drive (250GB at this point) and the R15 runs just fine. However, it still will only record 100Hrs of shows. That number must be hard coded.  

I've also tried installing a Master/Slave combination but the R15 doesn't seem to have any active code to see the slave unit or repartition/reformat/use it.

Now, some have asked, and I know some are curious as to how the R15 repartitions/formats a drive. It's all in the DOWN ARROW/REC function. You must start with a drive that has an R15 image but beyond that, if you perform the DOWN ARROW/REC the R15 will repartition/format the drive to the size of the drive.

I start by performing a Linux "dd" copy from the original 160GB drive to a 250GB drive. That results in a 250GB drive with a 160GB FAT32ish partition. Place that in your R15 and while it's booting do the DOWN ARROW/REC. you will end up with a 250GB partition and Fat32ish filesystem, of which you still will have only 100 hrs of recording time.

While I have not tried this, you could theoretically "dd" the 160GB drive to a 120/100/80, follow the same procedure and end up with....I don't know.

I also don't know if the R15 really needs a full "dd" copy of just sector 0 or sector 63. Those are the important sectors. If you have a HD sector editor and want to mount your R15 drive in your PC, you will notice some specifics in these sectors such as OEM ID.

Now, as I have stated before, I would not and do not place my R15 drive in any machine that has a chance of booting any version of Windows. Windows will see this as a 160GB FAT32 filesystem with no free space. But from mounting my test drives Windows will create System Volume info and Recycle info if you're running Norton Utilities.

I need to stress that if any of you are looking to "play" with your unit as I have, "play" with a backup drive.

So that's if for what I found with space. I'm currently rummaging through the few system type files on the HD and I'm nailing down what they appear to contain. The OS is nowhere on the HD. My test drive upgraded to 10B8 and when I installed my original R15 drive it ran fine and also had 10B8 without any upgrade process.


----------



## carl6

Wolffpack said:


> The OS is nowhere on the HD. My test drive upgraded to 10B8 and when I installed my original R15 drive it ran fine and also had 10B8 without any upgrade process.


Aha! Then whatever is preventing you from going past 100GB user partition is probably also in flash rom.

Is there any way to access that? Read it? Modify it?

Carl


----------



## Wolffpack

carl6 said:


> Aha! Then whatever is preventing you from going past 100GB user partition is probably also in flash rom.


Correct. Increasing beyond 100 hrs of recording time will involve a new release of software. Just as I would guess adding external hard drives and such will. Which is fine, just that DTV is hyping all of these features that at this time must just be on the drawing boards and not in any form already in software. Kinda Scary!



carl6 said:


> Is there any way to access that? Read it? Modify it?


Sure, requires the flash memory (M58LW064D/TBGA) being pulled from an R15 and read then....magic happens. . Need a reader for that particular chip and a spare R15 to offer to the gods. Although this isn't that bad of a chip as the 32MB chip (in the R15) has the same footprint as the 256MB chips.

However, all this, other than the pure "I wanna know" side it moot as most users would not go through the process to replace this chip. Myself, I wanna know. :grin:


----------



## ChrisWyso

OK, I know this something I'm constantly going on about but WTF? In the root file listings, 7 of the 8 files sitting there are DATABASES!! ".dbf" (for those unfamiliar) is a database file extension. So if they can write 7 to the HD, why not write an 8th with the guide data?

And thanks Wolffpack for your "digging"!

-Chris


----------



## Wolffpack

ChrisWyso said:


> OK, I know this something I'm constantly going on about but WTF? In the root file listings, 7 of the 8 files sitting there are DATABASES!! ".dbf" (for those unfamiliar) is a database file extension. So if they can write 7 to the HD, why not write an 8th with the guide data?
> 
> And thanks Wolffpack for your "digging"!
> 
> -Chris


You are welcome. But if you should really see what's in "jopa". As near as I can tell, it contains a combination of both the ToDo list and MYVOD. I'm working on dumps from these files and will be posting what I've found in the next few days.

Quickly though, "xcredit.dbf" contains actors that appear in MYVOD entries and also in the TDL. "signup.dbf" contains your Series Links. "xcatgry.dbf" contains what appears to be stupid show categories. Serious. Entries like "Documentary", "Western", "Cooking". This file looses me. They store categories but not the guide? Bizarre. Anyway, I'll post more soon including examples.


----------



## walters

Is it me or does 32MB seem a bit tight to put the OS and application?

BTW, a very good article where Jim Barton addresses exactly that issue (firmware versus hard drive) on page two.
http://acmqueue.com/modules.php?name=Content&pa=showpage&pid=381


----------



## Wolffpack

walters said:


> Is it me or does 32MB seem a bit tight to put the OS and application?
> 
> BTW, a very good article where Jim Barton addresses exactly that issue (firmware versus hard drive) on page two.
> http://acmqueue.com/modules.php?name=Content&pa=showpage&pid=381


Thanks for the link. Just started reading a bit and it's very interesting.


----------



## Clint Lamor

walters said:


> Is it me or does 32MB seem a bit tight to put the OS and application?
> 
> BTW, a very good article where Jim Barton addresses exactly that issue (firmware versus hard drive) on page two.
> http://acmqueue.com/modules.php?name=Content&pa=showpage&pid=381


Actually 32mb is quite a bit for an OS. Look at most routers and other appliance type machines. There was some version of Linux for appliances that was under 2mb for everything needed to get the box up and running.


----------



## pentium101

Wolffpack said:


> The OS is nowhere on the HD. My test drive upgraded to 10B8 and when I installed my original R15 drive it ran fine and also had 10B8 without any upgrade process.


Thanks for the update Wolffpack.

By locating the code in flash ROM, it looks like Dtv wants to have tighter control of what people will be able to do with these units.


----------



## pentium101

walters said:


> Is it me or does 32MB seem a bit tight to put the OS and application?


The UTV OS had fit within 32MB, so it is possible that the R15's OS could also be within this size.


----------



## leesweet

I saw the reference to the 100/60 limit being in the ROM, but I wonder if the limit (why they did that) was because they *do* have to chop the drive into two partitions? Tivos, of course, could use the whole thing for one purpose (more or less). And, yeah, on the R15, they could have said 'format the drive, create a 60GB partition, and then create a partition with all the balance for user use'.

Total BS here or what? Or they put it in ROM because they knew we would want to externally format drives as large as possible and restricted it to where we couldn't change it.


----------



## carl6

Wolffpack said:


> However, all this, other than the pure "I wanna know" side it moot as most users would not go through the process to replace this chip. Myself, I wanna know. :grin:


Isn't that exactly how the upgrades for the R10 are being done (beyond hard drive upgrade)? Yeah, I agree, most would not heat up a soldering iron to do an upgrade, but some will. And you only have to do that once. Put in a good socket for future replacements.

Carl


----------



## qwerty

walters said:


> Is it me or does 32MB seem a bit tight to put the OS and application?


Only if you use Microsoft as a benchmark. :lol:


----------



## Wolffpack

carl6 said:


> Isn't that exactly how the upgrades for the R10 are being done (beyond hard drive upgrade)? Yeah, I agree, most would not heat up a soldering iron to do an upgrade, but some will. And you only have to do that once. Put in a good socket for future replacements.
> 
> Carl


Yes, R10s need the PROM replaced to break the chain of trust which then allows OS & Application changes on the HD. HD upgrade does not require a PROM replacement. The replacement PROM has only a small change to allow the continuation of the boot process from disk. The R15 contains all the OS on the PROM, requiring much more modification to accomplish pretty much anything.


----------



## walters

qwerty said:


> Only if you use Microsoft as a benchmark. :lol:


How about if you use TiVo as a benchmark:



Code:


Filesystem         1024-blocks  Used Available Capacity Mounted on
/dev/hda4             126911   30233    90125     25%   /

We're not talking about a router, here. We're talking about a fairly complex application with significant features yet to be added (which will include a crapload of device drivers for USB ethernet, wireless, external drives, portable players, ...). If they're having to use low-level languages and/or program right to the hardware (i.e. no OS) just to fit it in 32MB, that would explain a lot about programmer productivity.


----------



## Clint Lamor

walters said:


> How about if you use TiVo as a benchmark:
> 
> 
> 
> Code:
> 
> 
> Filesystem         1024-blocks  Used Available Capacity Mounted on
> /dev/hda4             126911   30233    90125     25%   /
> 
> We're not talking about a router, here. We're talking about a fairly complex application with significant features yet to be added (which will include a crapload of device drivers for USB ethernet, wireless, external drives, portable players, ...). If they're having to use low-level languages and/or program right to the hardware (i.e. no OS) just to fit it in 32MB, that would explain a lot about programmer productivity.


Thats also saying for sure that the entire boot process is on the flash. It is highly possible that some of these files are on the drive and the main OS and boot code are on the flash. Wouldn't be the first time and won't be the last time I have seen this done.


----------



## Wolffpack

Yea, I don't think the 32MB size should be a problem as the Tivo units have a 12MB partition and in walters case only 25% of that is being used. As I've mentioned I do believe the R15 is using the ERTFS file system but I have no guess what RTOS they may be using. If it was home grown or a commercial product like VxWorks.

I'm not sure if I've posted this link yet, but here's a place you can do some more reading on ERTFS. http://www.ebsembeddedsoftware.com/product_download_ERTFS.htm


----------



## Wolffpack

Clint Lamor said:


> Thats also saying for sure that the entire boot process is on the flash. It is highly possible that some of these files are on the drive and the main OS and boot code are on the flash. Wouldn't be the first time and won't be the last time I have seen this done.


I haven't seen any indication that the R15 has any executable code on the HD. Unless it is not being stored in a file and instead is stored in a group of sectors, it's just not on the drive. Since other files, SL, TDL and the video is stored in regular files on the HD I wouldn't see why they would hide executable code on raw sectors.


----------



## cabanaboy1977

Wolffpack, have you seen anything that would imply that the HD would or wouldn't be able to switch between two R15's? I still really wish we knew the answer to that, because that would be a major plus to the DVR. 

While you have been swapping drives, have you been able to take one of the drives with shows recorded and SL and swap it with a different drive with different shows and SL? Or have you just swapped the same data? I hope this makes sense. Basically if you take one of your imaged drives with 5 recording and swap it with a drive that has 10 recordings, does it make you format the drive with the down arrow/record? or will it come up with no issues?


----------



## walters

Wolffpack said:


> Yea, I don't think the 32MB size should be a problem as the Tivo units have a 12MB partition and in walters case only 25% of that is being used.


Check again. You're off by a factor of 10 (and the part being used is close to 32MB).


----------



## Wolffpack

walters said:


> Check again. You're off by a factor of 10 (and the part being used is close to 32MB).


Opps, correct. Fat fingers. :grin: Should have noticed from just the size of the number.


----------



## Wolffpack

cabanaboy1977 said:


> Wolffpack, have you seen anything that would imply that the HD would or wouldn't be able to switch between two R15's? I still really wish we knew the answer to that, because that would be a major plus to the DVR.
> 
> While you have been swapping drives, have you been able to take one of the drives with shows recorded and SL and swap it with a different drive with different shows and SL? Or have you just swapped the same data? I hope this makes sense. Basically if you take one of your imaged drives with 5 recording and swap it with a drive that has 10 recordings, does it make you format the drive with the down arrow/record? or will it come up with no issues?


I don't see why you couldn't swap a HD from one R15 to another. I've done the "dd" copy to a new drive and then repartitioned it. DOWN ARROW/REC must blow away the existing partition, create a new partition using the total space available on the drive and then do a quick format of the drive. Finally it creates "empty" versions of the files that reside on the drive. There could be an ID somewhere, but not that I've seen.

The different drives I've been testing with have different MYVODs and SLs on them. DOWN ARROW/REC removes all recordings & SLs so I just build them up again. The only reason for running the DA/R procedure is to expand the drive. If you don't perform that it will run using the copied data just fine.


----------



## cabanaboy1977

Wolffpack said:


> I don't see why you couldn't swap a HD from one R15 to another. I've done the "dd" copy to a new drive and then repartitioned it. DOWN ARROW/REC must blow away the existing partition, create a new partition using the total space available on the drive and then do a quick format of the drive. Finally it creates "empty" versions of the files that reside on the drive. There could be an ID somewhere, but not that I've seen.


That is a good sign. Coming from the UTV world, that would have been helpful when a tuner died on those. But the UTV married with the drive so you couldn't just swap the drives.


----------



## Wolffpack

walters said:


> Check again. You're off by a factor of 10 (and the part being used is close to 32MB).


Yes, wrong on that plus, one other missing factor. Tivo's has it's root partition plus the /var partition that holds temp data, caches, guide data and such. On one of my HDVR2s right now it shows:



Code:


Guest-tivo:/var/tmp$ df -h
Filesystem            Size  Used  Avail  Capacity Mounted on
/dev/hda7             124M   48M    70M     41%   /
/dev/hda9             124M   23M    94M     20%   /var

So the Series 2 DTivos are working with a 124MB root partition (hda7) containing the OS/drivers & such and a 124MB /var partition containing the guide data and quite a bit of cache data.

So in this one case we're talking about 71MB of data on the hard drive. On the R15 you've got a 32MB Flash chip and 64MB RAM. Now I do believe the DTivos have 42MB of RAM.

Granted, some of the HD space listed in my example above is consumed by the hacks I have installed. Let's say 10MB of hack stuff mostly consumes by the Utilities, Tivowebplus and MFS_FTP. But in the end, 32MB is pretty skinny given the plans for the R15. Unless those grand plans are in the works for the R20 or R25. We could very well be looking at the announcement of a R20 and HR20 at the same time.


----------



## pentium101

Wolffpack said:


> I haven't seen any indication that the R15 has any executable code on the HD. Unless it is not being stored in a file and instead is stored in a group of sectors, it's just not on the drive. Since other files, SL, TDL and the video is stored in regular files on the HD I wouldn't see why they would hide executable code on raw sectors.


Hiding code on raw sectors is *exactly* how it was done on the UTV. The ROM only contained boot code to check for the OS on the drive and if it was not found, it prompted you to connect to MSN for a download.

I see that you've only been dd'ing the entire drive onto the larger drive, but have you just tried formatting the new drive with a FAT32 partition and directly copying the files from the original drive to the new one?

That would definitely tell you if the OS code is in ROM or hidden somewhere on the drive.


----------



## Wolffpack

pentium101 said:


> I see that you've only been dd'ing the entire drive onto the larger drive, but have you just tried formatting the new drive with a FAT32 partition and directly copying the files from the original drive to the new one?


The partition isn't a true FAT32. For example, looking at the partition from Linux or using DOS based utilities it shows that the drive is completely full. So the FAT must have all clusters marked as "in use".

Next step I'm going to try is to write zeros to my test drive and then only copy sector 0 and 63 from the live drive to my test one to see if that properly reformats.


----------



## Wolffpack

After zeroing out my test 250GB drive (WD 250 using WD Diags V 4.15C) I copied only sector 0 and sector 63 from my original R15 160GB drive to the 250. Placed that in the R15 and performed DA/R as it was booting for the first time. The result was that the R15 created a 250GB FAT32ish partition and formatted it correctly for 250GB. The R15 also populated the initial set of files on the 250GB drive. I had not copied those files over, only sector 0 and sector 63.

The end result was a "virgin" R15 drive with zeros written at all sectors and the following files created:



Code:


total 4096
-rwxr-xr-x  1 root root 3133220 2006-04-24 21:09 jopa
-rwxr-xr-x  1 root root    4976 1980-01-01 00:01 pman.dbf
drwxr-xr-x  2 root root   32768 2006-04-24 21:09 rbs001
-rwxr-xr-x  1 root root  239202 1980-01-01 00:01 signup.dbf
-rwxr-xr-x  1 root root   16104 1980-01-01 00:01 supp.dbf
-rwxr-xr-x  1 root root   52292 2006-04-24 21:09 xcatgry.dbf
-rwxr-xr-x  1 root root    4346 1980-01-01 00:01 xclient.dbf
-rwxr-xr-x  1 root root  526104 1980-01-01 00:01 xcredit.dbf
-rwxr-xr-x  1 root root     532 2006-04-24 21:09 xsetup.dbf

At this point I would say the logic to create these files resides in the 32MB Flash chip which would not take much space as these files are only initialized to x00's at first and then are populated while you interact with your R15. This sequence is performed as a result of DA/R. (Also, see below as I'm trying to verify some differences I'm seeing in the actual chips being used.)

Maybe some of you would ask "But couldn't the hidden software also be written to the new HD just as these files are?". Yes it could. But it would REALLY be stupid to store this hidden code on the Flash Chip (taking up part of it's 32MB) only to copy it out to some super secret place on the HD.

In the end, I'm going with NO, the R15 doesn't have any OS or software residing on the HD. Only about 4MB of config files exist on the HD.

In addition to this info, I also noticed that my "Recent Finds" carried over after the install of a completely virgin drive. Leads me to believe that for some reason, recent finds are stored on one of the non-volatile chips on board the R15. Probably stored in the same place the original setup information is stored.

I have noticed discrepancies in the R15 Block Diagram submitted to the FCC for testing. Descriptions in the Block Diagram do not match the description of the chip part number also provided in the Block Diagram. I'm looking into those differences and will report what I eventually find. I'm planning on getting the actual part numbers off the actual chips in my -500 version to see what's really in the unit.

The following are HEX dumps of Sector 0 and 63 is you're interested.

View attachment 3462


View attachment 3463


----------



## d0ug

Have you looked at what format the video is stored in?

Is it MPEG2/4 which might be playable directly on a PC, The raw encrypted stream from the sat, which I guess wouldn’t be playable on a PC because the access card would be needed to decode the data, or some other kind of proprietary codec?

I've always wondered if the DVR was just dumping the raw data off the dish onto the HD, or if it was reencoding it to some other codec.


----------



## davefred99

d0ug said:


> Have you looked at what format the video is stored in?
> 
> Is it MPEG2/4 which might be playable directly on a PC, The raw encrypted stream from the sat, which I guess wouldn't be playable on a PC because the access card would be needed to decode the data, or some other kind of proprietary codec?
> 
> I've always wondered if the DVR was just dumping the raw data off the dish onto the HD, or if it was reencoding it to some other codec.


I would like to know that answer too. I really don't care how big the hardrive partitions are. I just want to be able to access and distribute my recorded files over my home networked pc's.Nothing else matters to me if I can only watch recored shows from one box. The more they lock us down the more determined I am to defeat it. I am not talking about sharing with friends or over the internet, just my for my own personal and family pleasure. Its been rumored that there might be a Direct Tv to go feature in the future but I doubt it will be anything near what I want but if they actualy ever do implement it then I am sure it wont take long for some smart folks to figure out how to make it work like we really want it too.


----------



## Wolffpack

d0ug said:


> Have you looked at what format the video is stored in?
> 
> Is it MPEG2/4 which might be playable directly on a PC, The raw encrypted stream from the sat, which I guess wouldn't be playable on a PC because the access card would be needed to decode the data, or some other kind of proprietary codec?
> 
> I've always wondered if the DVR was just dumping the raw data off the dish onto the HD, or if it was reencoding it to some other codec.


Unfortunately no. The actual video streams cannot be read as they are not stored in a true FAT32 filesystem. They must take into account the fact that these streams may be larger than the 4GB limits of FAT32 and this have a different design. If anyone has access to ERTFS drivers for Linux, please PM me.

At this point, trying to copy the stream off using various Linux OSes results in nothing.


----------



## cabanaboy1977

Wolffpack said:


> In addition to this info, I also noticed that my "Recent Finds" carried over after the install of a completely virgin drive. Leads me to believe that for some reason, recent finds are stored on one of the non-volatile chips on board the R15. Probably stored in the same place the original setup information is stored.


I doubt it, but could it be possible that the recent finds are on the 0 or 63 sector?


----------



## Wolffpack

cabanaboy1977 said:


> I doubt it, but could it be possible that the recent finds are on the 0 or 63 sector?


Nope. Checout my post a few back. I attached dumps of both sectors. #0 is your standard partition sector and #63 is your standard FAT32 header.


----------



## cabanaboy1977

Wolffpack said:


> Nope. Checout my post a few back. I attached dumps of both sectors. #0 is your standard partition sector and #63 is your standard FAT32 header.


That's what I thought, was just checking. That's odd that the recent finds are on the chip. Do those get cleared out when you reset the unit, like guide data?


----------



## Wolffpack

cabanaboy1977 said:


> That's what I thought, was just checking. That's odd that the recent finds are on the chip. Do those get cleared out when you reset the unit, like guide data?


Nope. I found it strange also. Save Recent Finds between resets but scrap the guide data and even your zipcode for weather.


----------



## walters

Wait: what else is stored in flash? How about SLs (would explain the limit of 50)?
Edit: nevermind, I just went back and re-read one of your earlier posts that addresses that.


----------



## cabanaboy1977

Wolffpack said:


> Nope. I found it strange also. Save Recent Finds between resets but scrap the guide data and even your zipcode for weather.


That is messed up. Why save the recent finds and not the guide data and zipcodes like you said.


----------



## canekid

I have looked at this early on, back in January.

What I found was that Stream.str contains the video data is virtually linked to the actual data, in what apears to be a security issue.

Here is my original post:

The R15 apears to use FAT32.

However it is a modified or a dual file system.

Each directory contains a Stream.str file, that technically is not
there. (phantom) When using WinHex to view the file system the
Stream.str files are not there. There is a strangle hidden
directory, but I can not access it.

The first 512MB of the hard disk is compressable to 1.2MB, which it
contains mostly Zeros.

Where the real data shows up is around C0000000, a bit earlier. This
data goes on for hundreds of megs. Since my recordings consist of 30
percent disk usage, I figure that this data area should not be more
than a third of the disk, which apears to be true.

I saved 512MG of data from this section, which compresses to 495MB.
This tells me I have the right area. Althogh there seems to be
another recording data area at the end of the disk.

The "data stream" is broken up into parts. Beginning with Gy (47FF)
after 132 bytes (47FF) repeats. It's over and over for the whole
length of the data area, possibly gigs of data.

Every so often there is a field of FFFF 95 byts long, and a field of
EF 9F A7 09 2B D5 7A B1 aproxiately 80 bytes long.

Here is a sample:


----------



## Clint Lamor

cabanaboy1977 said:


> That is messed up. Why save the recent finds and not the guide data and zipcodes like you said.


I seriously doubt you could fit all the guide data along with the OS and other things needed in the flash. Just a guess but I think that would be a huge amount of data.


----------



## AlbertZeroK

Clint Lamor said:


> I seriously doubt you could fit all the guide data along with the OS and other things needed in the flash. Just a guess but I think that would be a huge amount of data.


I would tend to agree with that. Also writting the recent finds to the flash would tend to wear out the flash as well, so I would guess (and I stress guess) that this information is comming off the hard drive.


----------



## canekid

Guide data for two weeks can take anywere from 24MB to 70MB in binary form. But that would be for all channels. I think a 24 hour/48 hour guide stored in RAM is basicly true.

Has anyone identified how much RAM the unit has?


----------



## cabanaboy1977

Clint Lamor said:


> I seriously doubt you could fit all the guide data along with the OS and other things needed in the flash. Just a guess but I think that would be a huge amount of data.


Your right I didn't mean that they'd keep it on board. I was just shocked that they desided to recent finds but not even keep guide data (regardless of where it is).


----------



## cabanaboy1977

AlbertZeroK said:


> I would tend to agree with that. Also writting the recent finds to the flash would tend to wear out the flash as well, so I would guess (and I stress guess) that this information is comming off the hard drive.


That would make sense, but Wolffpack only copied sector 0 and 63. Wolfpack said


Wolffpack said:


> #0 is your standard partition sector and #63 is your standard FAT32 header.


and after copying just that he still had his recent finds. So the recent finds are onboard not on the drive. I think that's really weird thought.


----------



## Wolffpack

canekid said:


> Guide data for two weeks can take anywere from 24MB to 70MB in binary form. But that would be for all channels. I think a 24 hour/48 hour guide stored in RAM is basicly true.
> 
> Has anyone identified how much RAM the unit has?


It has two Samsung K4H561638F-TCB3's on board, 64MB I believe.

EDIT: Link to specs: http://www.samsung.com/Products/Sem...M/Component/256Mbit/K4H561638F/K4H561638F.htm


----------



## canekid

Wolffpack said:


> It has two Samsung K4H561638F-TCB3's on board, 64MB I believe.


Then it would seem to me that this is what's happening. 32MB FlashROM for the OS and 64MB Ram for mostly EPG data. There might be an EEPROM for config data. Is that possible?

It's reasonable to believe that lockups occour when the EPG data get's corrupt, therefore engineers decideded to not have this on the HDD. Corupt data will be dumped automatically with a reset or power cycle.

If people are having problems with their R15, maybe they need to check their signal, switches and LNBs.


----------



## Wolffpack

canekid said:


> Then it would seem to me that this is what's happening. 32MB FlashROM for the OS and 64MB Ram for mostly EPG data. There might be an EEPROM for config data. Is that possible?


There is a 32K EEPROM also on board (24LC256).


----------



## Clint Lamor

cabanaboy1977 said:


> That would make sense, but Wolffpack only copied sector 0 and 63. Wolfpack said
> 
> and after copying just that he still had his recent finds. So the recent finds are onboard not on the drive. I think that's really weird thought.


Todays flash can take a lot of rewrites, I can imagine the box would probably die or cease of any use well before you exceed the write ability of the flash memory.


----------



## Wolffpack

cabanaboy1977 said:


> That would make sense, but Wolffpack only copied sector 0 and 63. Wolfpack said
> 
> and after copying just that he still had his recent finds. So the recent finds are onboard not on the drive. I think that's really weird thought.


Correct, wrote zeros to the WD250, took 11 hours via WD's diag software, then copied 2 sectors (0 and 63) of 512 bytes each. Recent Finds were not in those.


----------



## canekid

There are two ways D* could have done this, however they took the less popular way. Since they have not enabled "Showcases"

MyVOD area is set to 100GB. It's not a partition, just a storage limit. Showcases does not have this ???, it probably will take up the rest of the space. So if you do install the 250GB drive, great you are just giving more space to D* to sell you PPV content.

D* may have modeled this after Dish. Dish has done this with their DVR-625, dedicate 100GB to DVR content, and the rest goes to Dish's on demand content/PPV.

D* could have done it another way, reserve 60GB for Showcases, and give the rest to MyVOD, so we could upgrade the size of the drive and be happier.

I believe the logic behind this is business/financial. D* wants to be able to control when and how we upgrade the R15. They locked the primary drive to 100GB MyVOD so that we buy their USB add-on.

I wonder if the IDE controller is capable of slaving a second drive.

@Wolffpack, can you take a clean drive with sector 0 and 63 restored and put it in with your working test drive, and see what happens when you do a Down Arrow/Rec sequence?


----------



## Wolffpack

canekid said:


> I wonder if the IDE controller is capable of slaving a second drive.


I tried this and the R15 didn't seem to see the slave drive. Hard to tell if it saw it or not.



canekid said:


> @Wolffpack, can you take a clean drive with sector 0 and 63 restored and put it in with your working test drive, and see what happens when you do a Down Arrow/Rec sequence?


I did exactly that and DA/R reformatted/partitioned the drive and created a fully functional R15 drive with 100 hrs of recording space. This was on a 250GB drive.


----------



## d0ug

Earlier this month I had suspected that the 100gig/hr limit was in the firmware.

http://www.dbstalk.com/showpost.php?p=561569&postcount=6

I read on another forum or site that someone had tried putting a larger drive in and it worked, but didn't increase the recording time.

There's no telling if the VOD is hard coded to 60gig/hr or if it uses the remainder of the drive.

It's possible that the fat and partition sectors are in the firmware, and just copied to the drive, assuming that the drive is the same factory 160gb, in essence the 250gb drive is formatted to 160 and the rest is waste.


----------



## Wolffpack

d0ug said:


> Earlier this month I had suspected that the 100gig/hr limit was in the firmware.
> 
> http://www.dbstalk.com/showpost.php?p=561569&postcount=6
> 
> I read on another forum or site that someone had tried putting a larger drive in and it worked, but didn't increase the recording time.


Can you remember where you ran across this? I've found the same and would like to read any other posts in any other forums in relation to this.



d0ug said:


> There's no telling if the VOD is hard coded to 60gig/hr or if it uses the remainder of the drive.
> 
> It's possible that the fat and partition sectors are in the firmware, and just copied to the drive, assuming that the drive is the same factory 160gb, in essence the 250gb drive is formatted to 160 and the rest is waste.


No. I believe the OS is in Flash Memory. I'm not really sure what you're saying in that last statement. Sector 0 and sector 63, from my testing, is required for the R15 boot process (or DA/R) process to continue. I do not believe the content of those sectors are in "firmware" and I know there is no check against the factory drive.

160GB/250Gb drives and the ability to reformat/repartition them....I've already covered that above.

I have also stated above that I believe the limit on recording space on the R15 is not according to disk space. It's based on total time of recorded shows. I've filled up my R15 4 times so far and each time the recorded shows added up to 100 hrs, regardless of show content. Once was just HeadLine news and once was movies with alot of action. The other two times were plain series shows. Each time the end result was > 100 hrs but < 102 hrs once added up the time in each show under MYVOD.

We are all accustom to recording limits being imposed by the space available on the HD. The R15 doesn't work that way.

At lease in my mind. Guess I need to change my SIG to reflect this.


----------



## Clint Lamor

Wolffpack said:


> Can you remember where you ran across this? I've found the same and would like to read any other posts in any other forums in relation to this.
> 
> No. I believe the OS is in Flash Memory. I'm not really sure what you're saying in that last statement. Sector 0 and sector 63, from my testing, is required for the R15 boot process (or DA/R) process to continue. I do not believe the content of those sectors are in "firmware" and I know there is no check against the factory drive.
> 
> 160GB/250Gb drives and the ability to reformat/repartition them....I've already covered that above.
> 
> I have also stated above that I believe the limit on recording space on the R15 is not according to disk space. It's based on total time of recorded shows. I've filled up my R15 4 times so far and each time the recorded shows added up to 100 hrs, regardless of show content. Once was just HeadLine news and once was movies with alot of action. The other two times were plain series shows. Each time the end result was > 100 hrs but < 102 hrs once added up the time in each show under MYVOD.
> 
> We are all accustom to recording limits being imposed by the space available on the HD. The R15 doesn't work that way.
> 
> At lease in my mind. Guess I need to change my SIG to reflect this.


I think he's saying that regardless of if you have 160gb or 250gb the R15 won't ever use more then 160gb.


----------



## Wolffpack

Clint Lamor said:


> I think he's saying that regardless of if you have 160gb or 250gb the R15 won't ever use more then 160gb.


Well, kinda. Right now, with 10B8 the R15 won't use more than 100 Hrs.


----------



## Clint Lamor

Wolffpack said:


> Well, kinda. Right now, with 10B8 the R15 won't use more than 100 Hrs.


Would be intersting to know if the VOD portion of the drive is stuck at 60GB or if can grown and be used if you upgrade the drive.


----------



## walters

Wolffpack said:


> I have also stated above that I believe the limit on recording space on the R15 is not according to disk space. It's based on total time of recorded shows. I've filled up my R15 4 times so far and each time the recorded shows added up to 100 hrs, regardless of show content. Once was just HeadLine news and once was movies with alot of action. The other two times were plain series shows. Each time the end result was > 100 hrs but < 102 hrs once added up the time in each show under MYVOD.


That's interesting, and quite a cool feature IMO. What it sounds like they are doing is limiting recording time to 100 hours (whether that means 80GB or 120GB) and then (eventually) giving the remainder (approx 60 GB, but could be more or less depending on the type of user recordings) to VOD. So in a way you do get to use the "reserved space"--just to help make retention more deteriministic.


----------



## cabanaboy1977

Wolffpack, dumb question/suggestion here (not sure what this would or wouldn't tell us). What would happen if you recorded 20 hours of programing on a drive and then add those files to a drive that has 100hrs of recording?

Also I was just rereading a thread from dealbase and it's odd that windows XP didn't messup the drive "One interesting note, the MBR of the original drive contains no data (all 0's). After allowing XP to write its sig to the MBR, the drive still powered up fine in the R15."


----------



## Wolffpack

cabanaboy1977 said:


> Wolffpack, dumb question/suggestion here (not sure what this would or wouldn't tell us). What would happen if you recorded 20 hours of programing on a drive and then add those files to a drive that has 100hrs of recording?


Problem here is that I have not found a way to copy the actual video/audio stream. It shows as a file but when trying to copy it you only get the first 32768 bytes and then an I/O error on Suse. Fedora and Knoppix copy only x00 after those first 32768 bytes. Something with that file is preventing Linux from accessing it.



cabanaboy1977 said:


> Also I was just rereading a thread from dealbase and it's odd that windows XP didn't messup the drive "One interesting note, the MBR of the original drive contains no data (all 0's). After allowing XP to write its sig to the MBR, the drive still powered up fine in the R15."


The MBR is sector 0. It's not all zeros. I read through that thread also and I'm not sure how the poster saw all zeros in sector 0. The contents of which are listed above.


----------



## cabanaboy1977

Wolffpack said:


> Problem here is that I have not found a way to copy the actual video/audio stream. It shows as a file but when trying to copy it you only get the first 32768 bytes and then an I/O error on Suse. Fedora and Knoppix copy only x00 after those first 32768 bytes. Something with that file is preventing Linux from accessing it.


Can you do that byte by byte copy (like you copied the 0 and 63) and just copy the bytes of that file. I don't know much about that and i'm sure if you could you would have.



Wolffpack said:


> The MBR is sector 0. It's not all zeros. I read through that thread also and I'm not sure how the poster saw all zeros in sector 0. The contents of which are listed above.


Yeah, I didn't know anything about that 0 thing, I just thought that it was intersting that XP didn't messup the disk.


----------



## Wolffpack

cabanaboy1977 said:


> Can you do that byte by byte copy (like you copied the 0 and 63) and just copy the bytes of that file. I don't know much about that and i'm sure if you could you would have.


In a typical FAT32 filesystem you can trace the FAT entries and get to the data. The problem here is that the R15 is not using the standard FAT32 filesystem. Kinda FAT64 with extensions. One reason it supports file > 4GB.

I have not actually chased down the cluster links to try to pull a stream file from the R15. If anyone else has, please post your results.


----------



## Daniel Berlin

Wolffpack said:


> Problem here is that I have not found a way to copy the actual video/audio stream. It shows as a file but when trying to copy it you only get the first 32768 bytes and then an I/O error on Suse. Fedora and Knoppix copy only x00 after those first 32768 bytes. Something with that file is preventing Linux from accessing it.
> .


So uh, is the I/O error that shows up in the kernel logs say that it is trying to access sectors that are out of bounds (which means it's an FS issue), or something weirder, like the drive not responding properly?


----------



## Wolffpack

Daniel Berlin said:


> So uh, is the I/O error that shows up in the kernel logs say that it is trying to access sectors that are out of bounds (which means it's an FS issue), or something weirder, like the drive not responding properly?


I'm guessing FS. Linux mounts the FS as a FAT32. But if the R15 is using ERTFS as I believe, it adds it's own extensions and could cause Linux to try grabbing a cluster/sector that out of the bounds of the HD/FS.

OTOH, this only happens on the video/audio stream files which could have some other encryption on them associated with the decoading hardware on the R15.

Or....I don't know.


----------



## cabanaboy1977

Wolffpack said:


> In a typical FAT32 filesystem you can trace the FAT entries and get to the data. The problem here is that the R15 is not using the standard FAT32 filesystem. Kinda FAT64 with extensions. One reason it supports file > 4GB.
> 
> I have not actually chased down the cluster links to try to pull a stream file from the R15. If anyone else has, please post your results.


Thanks, that makes sense. Thanks for the explaination.


----------



## Dan East

This probably won't help a whole lot, but this document describes some of the features of the ERTFS (contiguous files, circular files, 64 bit support, etc):
Market Trends

The actual pdf is no longer there, so that's a link to Google's cached version in html.

So the two tasks are:
Extract files from ERTFS
Decryption of files.

The former shouldn't be too hard - someone could always purchase licensing from EBSnet to gain access their filesystem libraries.
Considering that the files are MPEG-2, they should contain known header information that could possibly be used in an attack against the encryption algorithm. Whatever they are using, it has to be very fast to encrypt and decrypt large volumes of data real-time, so hopefully that will be its weakness (IE not having much processing power available to do the task real-time, so the algorithm is simple).

This should certainly be possible, especially since they are using off-the-shelf technology licensed from EBSnet. There are people out there that have worked with their systems that could at least access and decompile the firmware to see how the encryption is done (assuming it isn't done by a dedicated chip).

Dan East


----------



## jonaswan2

Dan East said:


> This probably won't help a whole lot, but this document describes some of the features of the ERTFS (contiguous files, circular files, 64 bit support, etc):
> Market Trends
> 
> The actual pdf is no longer there, so that's a link to Google's cached version in html.
> 
> So the two tasks are:
> Extract files from ERTFS
> Decryption of files.
> 
> The former shouldn't be too hard - someone could always purchase licensing from EBSnet to gain access their filesystem libraries.
> Considering that the files are MPEG-2, they should contain known header information that could possibly be used in an attack against the encryption algorithm. Whatever they are using, it has to be very fast to encrypt and decrypt large volumes of data real-time, so hopefully that will be its weakness (IE not having much processing power available to do the task real-time, so the algorithm is simple).
> 
> This should certainly be possible, especially since they are using off-the-shelf technology licensed from EBSnet. There are people out there that have worked with their systems that could at least access and decompile the firmware to see how the encryption is done (assuming it isn't done by a dedicated chip).
> 
> Dan East


Read my thread, there is a special chip used to decode the video in the R15, it's called SVC. The R15 is one tough cookie.


----------



## wbmccarty

Spin-vector ciphers (SVC) seem pretty reliable. But, at issue is the quality of the implementation of SVC and the application using it, not the SVC scheme itself. For instance, I understand that SVC encryption uses a password, the recovery of which would permit decryption of SVC-encrypted data. 

Thus arises the question, Where is the password stored within the R15? Answer that question, young grasshopper, and the path of enlightenment shall open before you.


----------



## jonaswan2

wbmccarty said:


> Spin-vector ciphers (SVC) seem pretty reliable. But, at issue is the quality of the implementation of SVC and the application using it, not the SVC scheme itself. For instance, I understand that SVC encryption uses a password, the recovery of which would permit decryption of SVC-encrypted data.
> 
> Thus arises the question, Where is the password stored within the R15? Answer that question, young grasshopper, and the path of enlightenment shall open before you.


Did I say SVC? I meant SVP.

There is an alliance!

Whoops, my bad:blush:


----------



## Wolffpack

Dan East said:


> The former shouldn't be too hard - someone could always purchase licensing from EBSnet to gain access their filesystem libraries.


Yea, but that's a $5K gamble I'm not going to take.


----------



## wbmccarty

jonaswan2 said:


> Did I say SVC? I meant SVP.


That's okay. The actual cipher technology used doesn't much affect my argument. My point is that key (or password) exchange is a common point of vulnerability in cipher systems. The shared secret (password or key) needed to decrypt data must reside within the R15. Therefore, the secret is accessible and the data is insecure. It can be made hard to find and access (it's probably stored in encypted form), but it has to be there.


----------



## Dan East

wbmccarty said:


> That's okay. The actual cipher technology used doesn't much affect my argument. My point is that key (or password) exchange is a common point of vulnerability in cipher systems. The shared secret (password or key) needed to decrypt data must reside within the R15. Therefore, the secret is accessible and the data is insecure. It can be made hard to find and access (it's probably stored in encypted form), but it has to be there.


Has it been determied if a HDD can be swapped between R15s and the data is accessible on both units? If that cannot be done then they may have used something as simple as the ESN (directly or in some obfuscated way) as the key.

The thing is, you don't need some fancy chip to do the decryption. Any turing-complete device can emulate any other turing-complete device, _if the algorithm is known_ (although the execution time can vary drastically, which isn't an issue in this case).

Dan East


----------



## Wolffpack

Dan East said:


> Has it been determied if a HDD can be swapped between R15s and the data is accessible on both units? If that cannot be done then they may have used something as simple as the ESN (directly or in some obfuscated way) as the key.
> 
> The thing is, you don't need some fancy chip to do the decryption. Any turing-complete device can emulate any other turing-complete device, _if the algorithm is known_ (although the execution time can vary drastically, which isn't an issue in this case).
> 
> Dan East


I tried swapping drives but the spare R15 I have isn't activated. While the unit booted fine and showed channel 100, the DVR functions were not active so I couldn't test any further.


----------



## wbmccarty

Dan East said:


> Has it been determied if a HDD can be swapped between R15s and the data is accessible on both units? If that cannot be done then they may have used something as simple as the ESN (directly or in some obfuscated way) as the key.
> 
> The thing is, you don't need some fancy chip to do the decryption. Any turing-complete device can emulate any other turing-complete device, _if the algorithm is known_ (although the execution time can vary drastically, which isn't an issue in this case).


My guess is that they use a hashed combination of a relatively lengthy secret key and a potentially shorter ESN that''s based on data stored on the access card. But, that's just a guess.


----------



## Dan East

After reading as much as I could find about ERTFS, I have a theory why it is limited to 100 hours. The key to acceptable performance on a device of this nature, which deals with files of massive size, is that the files be contiguous on disk. ERTFS helps this along by providing an API exposing lower-level access to the filesystem. In order for the files to be contiguous some higher-level method of mapping files to disk must exist. For example, only allocating file slots in increments of 30 minutes, and aligning hour long shows in even slots (assuming that the bitrate is fixed or various only slightly, or by always utilizing the highest possible bitrate to allocate slots).

Thus the firmware would maintain a table of available 30 minute slots - which is currently hardcoded for 100 hours worth of programming.

One relatively simple method to determine what allocation size they are using (15 minute, 30 minute, etc) would be to record just a couple minutes of different shows until the free space meter reaches 10%:
Number of shows / Allocation size
10 / 1 hour
20 / 30 minutes
40 / 15 minutes
60 / 10 minutes

We moved and our dish isn't hooked up yet, so I can't try it for myself.

Dan East


----------



## Wolffpack

Interesting Dan. Good points. I'm sure the 100 hrs is hard coded. But I would guess you're giving way too much credit to the developers with your theory.

My ERTFS reading shows it's not a bad filesystem, actually pretty good. It provides functions for grabing large chunks of space and also allows reorganization of the filesystem from the application level. I just don't think the major features of ERTFS have been implemented on the R15.

Given the current state of the R15 software, and the fact it's been out for 6 months now, there are two options.

1) The software was so cobbled together to begin with that the developers can't even find where the problems exist in the code.

2) There's two guys in El Segundo working on the project.

Oh, and as an aside, if anyone has access to ERTFS drivers and would like to try some tests, let me know via PM.


----------



## qwerty

Wolffpack said:


> Interesting Dan. Good points. I'm sure the 100 hrs is hard coded. But I would guess you're giving way too much credit to the developers with your theory.
> 
> My ERTFS reading shows it's not a bad filesystem, actually pretty good. It provides functions for grabing large chunks of space and also allows reorganization of the filesystem from the application level. I just don't think the major features of ERTFS have been implemented on the R15.
> 
> Given the current state of the R15 software, and the fact it's been out for 6 months now, there are two options.
> 
> 1) The software was so cobbled together to begin with that the developers can't even find where the problems exist in the code.
> 
> 2) There's two guys in El Segundo working on the project.
> 
> Oh, and as an aside, if anyone has access to ERTFS drivers and would like to try some tests, let me know via PM.


El Segundo, India?


----------



## Wolffpack

qwerty said:


> El Segundo, India?


:icon_lol:


----------



## wbmccarty

qwerty said:


> El Segundo, India?


No, if Indian software engineers had been doing the work, we would not likely be experiencing the high number of defects reported here. Those guys, for the most part, take software engineering pretty seriously. We here in the U.S. think it's merely another term for programming.


----------



## P Smith

Just for correction - that TBGA chip have size 64 Mbits, i.e. 8 MBytes.


----------



## jpsage

Super Great Post! Thank you. I have been trying to find more technical info about this box. I am on my second one and am going to take maters into my own hands. Hopefully I will be able to dup the HD and get back up and running.

OBTW, have you tried to put a bare drive in? Curious if the onboard sw will format the disk from scratch. It would certianly reduce the unit cost and make life easier for us. 

thanks.


----------



## Clint Lamor

wbmccarty said:


> No, if Indian software engineers had been doing the work, we would not likely be experiencing the high number of defects reported here. Those guys, for the most part, take software engineering pretty seriously. We here in the U.S. think it's merely another term for programming.


That is one of the funniest things I have ever read. I am not referring to the U.S. part either.


----------



## jonaswan2

Clint Lamor said:


> That is one of the funniest things I have ever read. I am not referring to the U.S. part either.


I thought XTV was developed in the UK?

Then DirecTV got ahold of it...


----------



## Clint Lamor

jonaswan2 said:


> I thought XTV was developed in the UK?
> 
> Then DirecTV got ahold of it...


XTV was developed by NDS which is Part of Rupert's holdings along with DiecTV.


----------



## jonaswan2

Clint Lamor said:


> XTV was developed by NDS which is Part of Rupert's holdings along with DiecTV.


Which is headquartered in the UK.


----------



## wbmccarty

Clint Lamor said:


> That is one of the funniest things I have ever read.


My point, exactly. Few U.S. software developers have even a rudimentary understanding, let alone an appreciation, of software engineering. In India, only the best students are _allowed_ to study software engineering.


----------



## Clint Lamor

jonaswan2 said:


> Which is headquartered in the UK.


Yes you are correct. Your point is?


----------



## jonaswan2

Clint Lamor said:


> Yes you are correct. Your point is?


Which is probably where they developed XTV. See where I'm going?

XTV = The DVR part of the R15

Slap on some other NDS technologies (like the DirecTV branded NDS Guide and Video Guard) and you have your DirecTV R15.


----------



## Clint Lamor

jonaswan2 said:


> Which is probably where they developed XTV. See where I'm going?
> 
> XTV = The DVR part of the R15
> 
> Slap on some other NDS technologies (like the DirecTV branded NDS Guide and Video Guard) and you have your DirecTV R15.


Yes I realize parts of the DVR softwre are from NDS which is from the UK. I guess I just must be missing something here.


----------



## jonaswan2

Clint Lamor said:


> Yes I realize parts of the DVR softwre are from NDS which is from the UK. I guess I just must be missing something here.


Well he Wolffpack sayed the software must be developed in El Segundo.

I was think it was the UK, since NDS made the software and all.


----------



## Wolffpack

jpsage said:


> Super Great Post! Thank you. I have been trying to find more technical info about this box. I am on my second one and am going to take maters into my own hands. Hopefully I will be able to dup the HD and get back up and running.
> 
> OBTW, have you tried to put a bare drive in? Curious if the onboard sw will format the disk from scratch. It would certianly reduce the unit cost and make life easier for us.
> 
> thanks.


A bare drive will not work. The R15 doesn't boot or even give you the two blue screens. All the drives need is for sector 0 and 63 to be copied from an existing drive to a new drive and then do the DOWN ARROW/REC reformat and that drive will be good to go.

Keep in mind that the new drive must be at least 160GB and, from my tests, not more than 250GB. A 300GB drive will not work in my testing. Also a 120GB drive will not work. IE, not boot.


----------



## Wolffpack

jonaswan2 said:


> Well he Wolffpack sayed the software must be developed in El Segundo.
> 
> I was think it was the UK, since NDS made the software and all.


I have no idea about anything.

I have no idea who developed the software nor where it's developed.

I have no idea of the R15 using ERTFS or any OS.

I don't know ANYTHING. I'm just guessing and postulating. Please, don't take anything I say as fact. I have no access to anything other than access any regular Joe with an R15 has.

But I can make some educated guesses!!! :grin:


----------



## laxcoach

wbmccarty said:


> My point, exactly. Few U.S. software developers have even a rudimentary understanding, let alone an appreciation, of software engineering. In India, only the best students are _allowed_ to study software engineering.


meh. This is not really the forum for this, but statements like this get under my skin.

I am an architect for a highly transactional system and most of my developers are Indian. They are no different than US developers. 5-10% are superstars. 50% have no motivation and the rest are serviceable at best. The only difference is they get paid slave wages compared to their US counterparts.

This is one of the great myths of this young century. They are _not_ trained as engineers any more than US developers.

That being said, I will hire a mechanical engineer as a programmer over a computer science graduate any day of the week. ME, EE, and IE graduates understand system engineering far better than someone who studied the abstract idea of object oriented programming. They translate into much better architects than a CS.


----------



## Clint Lamor

jonaswan2 said:


> Well he Wolffpack sayed the software must be developed in El Segundo.
> 
> I was think it was the UK, since NDS made the software and all.


I am guessing parts of the software where developed by NDS in the U.K. and parts of whats in use at DirecTV was developed here in the US.


----------



## wbmccarty

laxcoach said:


> I am an architect for a highly transactional system and most of my developers are Indian. They are no different than US developers.


I agree that a random sample of experienced U.S and Indian software developers might not show substantial individual differences in skill, depending on how skills are measured. But, software process maturity has more to do with organizational processes than the skills of individual developers. Indeed, that's the whole point: to avoid a situation in which product quality is chiefly determined only by the individual skill and effort of a few superstars.

You're right in pointing out that the reality isn't quite so simple as "India, good; U.S., bad." India has many low-skilled software developers. And, like the U.S., they have many software development organizations that are clueless with respect to software engineering. My guess is that their worst is worse than the U.S. worst. But, despite having a smaller software development industry than the U.S., India has 44% of all organizations world-wide that are certified at level 5, the highest level in the SEI's CMM benchmark. That indicates an important difference in software-engineering attitude.

The R15 is pretty clearly the work of a CMM level 1-2 organization. Some very skilled and talented folks are likely part of the R15 development team. But, their organization is hampering rather than helping their efforts. That is, the problem is the process, not the people.

P.S. Please consider that my claim concerned Indian "software engineers" not "software developers." From what you've written, I think we agree that your own Indian workers are developers, not engineers. And, I think we agree that calling someone an "engineer" doesn't make him/her one. With those clarifications, I'll stand on my claim that (bona fide) Indian software engineers wouldn't have created the mess we call the R15.

P.P.S. More generally, I claim that (bona fide) software engineers--of whatever nationality-- wouldn't have created the mess we call the R15. Humor aside, that's nearer the point I was trying to make.


----------



## qwerty

To prevent us from getting back on topic... :lol:

Todays Dilbert is timely!

http://www.dilbert.com/


----------



## Clint Lamor

I will completely and totally disagree with you wbmccarty, but we need to end this discussion as it's not part of the topic and doesn't really belong here. If you want to discuss it further feel free to PM me and I will give you my professional experience in dealing with Engineers, Programmers and the such from around the world.


----------



## wohlfie

laxcoach said:


> meh. This is not really the forum for this, but statements like this get under my skin.
> 
> I am an architect .....
> 
> <snip>
> 
> .... They translate into much better architects than a CS.


Ok - completely inappropriate, off topic comment (not personally directed at you, laxcoach):

As someone who spent 5 years in undergraduate program, 2 years in a masters program, 11 years in the field (3+ as a required "experience"), and just spent some 30+ hours and $1000+ taking nine seperate exams to become a licensed architect (you know...the kind that designs builings) will people stop co-opting the title of my profession!!!

Aaaaarghhhhh......:bang :bang :bang


----------



## P Smith

30+ hours ? Huh ? You are fast  - for nine exams, in less then 4 working days period.


----------



## pentium101

Wow, this thread has gone way off-topic. :eek2:

It looks like the mods may have to split this thread and move these non-relevant posts into another thread.


----------



## Wolffpack

Yeah. Kinda!


----------



## wbmccarty

Hmm, it might be easier to move the _relevant_ posts to another thread.


----------



## Malibu13

wbmccarty said:


> Hmm, it might be easier to move the _relevant_ posts to another thread.


Easier for sure..................... since there is far less relevance than non.


----------



## cabanaboy1977

Wolffpack, any more updates or findings?


----------



## carl6

I have two R15's. One of them started experiencing problems, which I have identified to be heat related (see thread on "Problems").

Given that I tore into the bad R15 anyway, I decided to go a step further and do some comparison work between the two R15's. I'm posting here (in this thread) because this information is much more on topic with Wolffpack's observations in this thread than it is in the problems thread.

Both of my R15's are very early production - manufactured in July 05. Both have the A1 motherboard, and both have the funny set of symbols on the side of the chassis that I mentioned in the other thread - most likely some early QC checks done during the initial manufacturing run (speculation).

I pulled the hard drive out of the second (no heat problems) R15 and put it in the other one. When I fired the system up (I did not do a reformat), it came up okay, and looked like it was going to work, but then gave me an error message saying my access card had expired. I went into myVOD and all of the shows were there, but when trying to play one, I also got the access card expired message.

I put both drives back into their original units, and they both work just fine.

So, there is obviously information related to the access card ID stored on the hard drive. I did not try a reformat on the drive to see if that would allow it to work, because I did not want to lose what was already recorded on it.

The next thing I tried was to copy the drive from the "bad" R15 (keep in mind, the drive itself appears to be just fine) using Norton Ghost. Ghost gave me an error message about a bad sector somewhere on the drive, and did not produce a copy. Put the drive back into the R15, and it works just fine. I don't have Unix, so can't dd the drive.

So, just some information that may contribute to the theme of this thread.

Carl


----------



## Wolffpack

Carl,

If you want to play around with Linux you can grab a bootable CD here. You may also want to grab a copy of the Seagate diag CD from Seagate's support site. That should confirm HD problems.


----------



## Wolffpack

cabanaboy1977 said:


> Wolffpack, any more updates or findings?


Been pretty busy lately. Doesn't look like this week is shaping up any better.


----------



## cabanaboy1977

carl6 said:


> I pulled the hard drive out of the second (no heat problems) R15 and put it in the other one. When I fired the system up (I did not do a reformat), it came up okay, and looked like it was going to work, but then gave me an error message saying my access card had expired. I went into myVOD and all of the shows were there, but when trying to play one, I also got the access card expired message.


With this info I've got a pretty go feeling that if you do get a replacement R15 (due to non HD related issues) that you will be able to swap the drives. This sounds like the message you get with a valid access card in the wrong unit or replacing a card. It sounds like the access cards are marrying to the drive not the unit. Which makes me believe that if you had called up D* and had them walk you thru allowing that access card to use that HD.


----------



## jonaswan2

I assume the access card is married to everything *including* the hard drive.


----------



## Wolffpack

I cannot see how the card is married to the HD unless they plugged that value into sector 0 (boot sector) or Sector 63 (partition table). As stated before I have zeroed out a drive, copied sector 0 and sector 63 from an existing drive to the new drive and placed that in my R15. While booting I did the DA/R reformat which created and formatted a new filesystem. That new drive ran fine in the R15.

While I haven't performed a bit by bit analysis of those 2 512 byte sectors, they appear to have standard boot and partition sector values.


----------



## cabanaboy1977

Unless they marry it to the data on drive? Maybe drives that only have the 0 and 63 indicate to the HD to write the access card data to the drive? Something alerted the unit that the drive was once in another unit or vice versa.


----------



## walters

I would guess the data is encrypted using a key on the access card. This is very similar to what happens when you swap drives in a TiVo (the data there is encrypted using a key on the motherboard).

Didn't someone say there was a new access card for the R15s? This would explain how it differs from access cards meant for normal receivers and older DVRs.


----------



## Earl Bonovich

Or it is similar to the TiVos... where it encodes to the RID chip..
But on the R15, the error message is falling through as an Access Card error.

I can't see them tying to the Access Card.... 
What happens if the Access card goes bad (which they do)... then you would lose all access to your previously recorded content.


----------



## cabanaboy1977

Earl Bonovich said:


> I can't see them tying to the Access Card....
> What happens if the Access card goes bad (which they do)... then you would lose all access to your previously recorded content.


That's why i think we might be in the clear for HD swaps between units.

So at least we have the first step out of the way for swapping drives between units, it won't erase/reformat the drive if you do swap between different units. We just need someone to swap HD's between the units and see if they can get the CSR to make the access card work. If Carl ends up getting a replacement maybe he will have some luck doing it.


----------



## PlanetBill

Earl Bonovich said:


> Or it is similar to the TiVos... where it encodes to the RID chip..
> But on the R15, the error message is falling through as an Access Card error.
> 
> I can't see them tying to the Access Card....
> What happens if the Access card goes bad (which they do)... then you would lose all access to your previously recorded content.


I wouldn't think so...

I just recently put my -300 back into service, the access card that I had needed to be replaced. I recieved a new one and presto, my old recorded content was still there.


----------



## P Smith

There is pretty useful MS-DOS program running from self bootable floppy - MHDD.EXE v4.6.
What is nice - it will REMAP your HDD bad sectors and will make it works as new.


----------



## Earl Bonovich

PlanetBill said:


> I wouldn't think so...
> 
> I just recently put my -300 back into service, the access card that I had needed to be replaced. I recieved a new one and presto, my old recorded content was still there.


Well that is what I mean...

That there is no ACCESS CARD based information pieces in the encryption of the Video programs on the hard drive.


----------



## jonaswan2

Earl Bonovich said:


> Well that is what I mean...
> 
> That there is no ACCESS CARD based information pieces in the encryption of the Video programs on the hard drive.


Huh? According to NDS, the way the VideoGuard system works is that the content is stored with the same encryption incoming video has. So, the access card plays some part with the video you store on your hard drive.


----------



## Earl Bonovich

I don't know the inner workings of the unit....

But people have reported (just above as a matter of fact), that the Access card can be replaced and the video content is still accessable.

So unless "maybe" they tag in your account information...

Or maybe this software isn't as NDS driven as some believe it to be.

Access cards do go bad... There has to be a way for them to replace the access card, without losing the contents on the hard drive.
But again... I don't have access to the code, nor have any "inside information" on how the security mechanisms work.... nor do I want to know...


----------



## morgantown

The point here is to view your recordings with the R15 you need to disconnect it from the dish prior to activating AND have a valid access card. Any valid access card (i.e., one that has been married to the reciever) should work just fine.

The card is not tied to the HD, it is tied to the receiver. NDS, FWIW, has been providing access cards to DTV since prior to Rupert buying a majority interest in DTV (DTV and NDS even had a nice lawsuit pending prior to Rupert taking a majority interest).

IIRC, even the TiVos needed a valid access card (although they could be deactivated and still play prior recorded shows) to be able to view recorded content. Not to go too far OT...


----------



## jonaswan2

Earl Bonovich said:


> I don't know the inner workings of the unit....
> 
> But people have reported (just above as a matter of fact), that the Access card can be replaced and the video content is still accessable.
> 
> So unless "maybe" they tag in your account information...
> 
> Or maybe this software isn't as NDS driven as some believe it to be.
> 
> Access cards do go bad... There has to be a way for them to replace the access card, without losing the contents on the hard drive.
> But again... I don't have access to the code, nor have any "inside information" on how the security mechanisms work.... nor do I want to know...


This part of the software has nothing to do with XTV. It deals with the NDS VideoGuard system.

http://nds.com/conditional_access/xvideoguard.html

Only authorized viewers can watch content off of the disk. This works (from what I've read from NDS) the same way as getting video off of DirecTV's stream directly.


----------



## Earl Bonovich

Right, so you need an ACTIVE access card... so you need the Acess card to decode the encrypting protocals

But it doesn't have to be the same access card that was in the system when the recording was made... 

Thus, the recordings are not encoded with a piece of information from the access card.


----------



## qwerty

Do they "write" to the access card when they marry them? Maybe when they do that, it "authorizes" the hardware to decrypt the content?


----------



## Earl Bonovich

Something definintely happens to the newer cards during activation.

Either the RID or the Serial Number, or something "marring" the two together...


----------



## Wolffpack

jonaswan2 said:


> This part of the software has nothing to do with XTV. It deals with the NDS VideoGuard system.
> 
> http://nds.com/conditional_access/xvideoguard.html
> 
> Only authorized viewers can watch content off of the disk. This works (from what I've read from NDS) the same way as getting video off of DirecTV's stream directly.


Why do you believe the R15 is running the NDS VideoGuard system?


----------



## jonaswan2

http://nds.com/conditional_access/ca_showcase.html

And because, as Earl said, they have been using this technology before they were even related to NDS.

HERE WE GO A BETTER LINK

http://directv.com/DTVAPP/aboutus/headline.jsp?newsId=03_16_2004A


----------



## PlanetBill

morgantown said:


> The point here is to view your recordings with the R15 you need to disconnect it from the dish prior to activating AND have a valid access card. Any valid access card (i.e., one that has been married to the reciever) should work just fine....


The above is coreect, when I had a disabled access card I could not get anything, however as soon as the new card was put in, All functions started working. ONLY an access card married to the machine will work.


----------



## cabanaboy1977

Earl Bonovich said:


> Access cards do go bad... There has to be a way for them to replace the access card, without losing the contents on the hard drive.
> But again... I don't have access to the code, nor have any "inside information" on how the security mechanisms work.... nor do I want to know...


Maybe we're looking at this backwards. We know that Carl had two valid R15's and when he switched the HD's it says access card expired so there has to be some connection between the HD and the card. Maybe there is a code on the HD but that code is written to the card not the other way around? So when your card goes bad or you get a new card the HD writes that code to the card and marrys the card to the HD not the HD to the card?


----------



## jonaswan2

cabanaboy1977 said:


> Maybe we're looking at this backwards. We know that Carl had two valid R15's and when he switched the HD's it says access card expired so there has to be some connection between the HD and the card. Maybe there is a code on the HD but that code is written to the card not the other way around? So when your card goes bad or you get a new card the HD writes that code to the card and marrys the card to the HD not the HD to the card?


I don't think that's how it works, at least that's not how NDS says how it works. Actually, I'm not very clear on what NDS says, it's very confusing.


----------



## walters

I've got a hunch this is how they do it:

US6178242

Actually, just out of curiosity, if anyone could look around on the case and the menus for any patent numbers I'd appreciate it. I've looked at the owner's manual PDF, but there's nothing there.


----------



## carl6

I do not know how it is being done, but I do know specifically what I found when I did my test. Both R15's were active on my account. Both worked. When I moved the drive from one to the other, I got the error message, both when trying to watch live video, and when trying to watch something previously recorded. I was able to access menu's, and MyVOD did correctly show a list of all the recorded shows. I just could not play them.

I only tried one drive in the opposite unit, not both. Also, I intentionally did not try the clear and delete reset - that may well have allowed the drive to work with the unit (and may not have, really don't know).

I do agree, there must be a way to re-establish the authorization, however I don't know if that could be done without clearing the recordings on the drive. At the moment, I am not planning to replace the unit (as it is working fine now that I have the fan running in it). I'm not sure how adventurous I am going to be in doing further testing.

Carl


----------



## jonaswan2

carl6 said:


> I do not know how it is being done, but I do know specifically what I found when I did my test. Both R15's were active on my account. Both worked. When I moved the drive from one to the other, I got the error message, both when trying to watch live video, and when trying to watch something previously recorded. I was able to access menu's, and MyVOD did correctly show a list of all the recorded shows. I just could not play them.
> 
> I only tried one drive in the opposite unit, not both. Also, I intentionally did not try the clear and delete reset - that may well have allowed the drive to work with the unit (and may not have, really don't know).
> 
> I do agree, there must be a way to re-establish the authorization, however I don't know if that could be done without clearing the recordings on the drive. At the moment, I am not planning to replace the unit (as it is working fine now that I have the fan running in it). I'm not sure how adventurous I am going to be in doing further testing.
> 
> Carl


If you can understand the "abstract" description that walters linked to, I assume that's the way they do it as well. To bad I was lost from the word "A" .

Maybe someone can turn the discription into, I don't know, American English.


----------



## jonaswan2

walters said:


> I've got a hunch this is how they do it:
> 
> US6178242
> 
> Actually, just out of curiosity, if anyone could look around on the case and the menus for any patent numbers I'd appreciate it. I've looked at the owner's manual PDF, but there's nothing there.


I don't think there is anything in the system menus.

EDIT: Oh yeah, and about the ECM thing, the diagram from NDS doesn't help too much.


----------



## walters

jonaswan2 said:


> If you can understand the "abstract" description that walters linked to, I assume that's the way they do it as well. To bad I was lost from the word "A" .
> 
> Maybe someone can turn the discription into, I don't know, American English.


I'll give it a shot, only because I understand patents (but not necessarily the DirecTV authorization scheme).

The encrypted stream includes commands that the access cards know how to honor to allow you to view your subset of the programming. "Prior art" (existing technology: not TiVo--they refer specifically to a digital VCR patent) recorded the scrambled stream, expecting the smart card to be able to decrypt the content at playback time.

The problem (there's always a problem solved by a patent) is that if the operator changes access card technology (as they do to keep up with hackers), then recordings would no longer be playable. So the invention pretty much, and this part is way over my head, replaces the commands (ECMs) with new commands that would, somehow, be understood by a future valid access card for that device.


----------



## walters

But wait: that sounds like what TiVo does. Yes and no. In the most general sense, both this patent and the DTiVo receivers take an encrypted stream from the satellite and record a differently-encrypted stream on the disk. What is described in the patent is "a method" to generate that second stream. TiVo uses a different method.


----------



## jonaswan2

walters said:


> I'll give it a shot, only because I understand patents (but not necessarily the DirecTV authorization scheme).
> 
> The encrypted stream includes commands that the access cards know how to honor to allow you to view your subset of the programming. "Prior art" (existing technology: not TiVo--they refer specifically to a digital VCR patent) recorded the scrambled stream, expecting the smart card to be able to decrypt the content at playback time.
> 
> The problem (there's always a problem solved by a patent) is that if the operator changes access card technology (as they do to keep up with hackers), then recordings would no longer be playable. So the invention pretty much, and this part is way over my head, replaces the commands (ECMs) with new commands that would, somehow, be understood by a future valid access card for that device.


And for your service I will give you the patent number on my access card, 4,748,668 and others (of course) and they should NDS patent, but you probably already knew that.


----------



## walters

jonaswan2 said:


> And for your service I will give you the patent number on my access card, 4,748,668 and others (of course) and they should NDS patent, but you probably already knew that.


Feh, that's nearly 20-year-old access card technology (and, as such, about to become public domain). Thanks, though.


----------



## Wolffpack

carl6 said:


> I do not know how it is being done, but I do know specifically what I found when I did my test. Both R15's were active on my account. Both worked. When I moved the drive from one to the other, I got the error message, both when trying to watch live video, and when trying to watch something previously recorded. I was able to access menu's, and MyVOD did correctly show a list of all the recorded shows. I just could not play them.
> 
> I only tried one drive in the opposite unit, not both. Also, I intentionally did not try the clear and delete reset - that may well have allowed the drive to work with the unit (and may not have, really don't know).
> 
> I do agree, there must be a way to re-establish the authorization, however I don't know if that could be done without clearing the recordings on the drive. At the moment, I am not planning to replace the unit (as it is working fine now that I have the fan running in it). I'm not sure how adventurous I am going to be in doing further testing.
> 
> Carl


Did you try swapping the cards and the same time swapping the drives?


----------



## Wolffpack

jonaswan2 said:


> http://nds.com/conditional_access/ca_showcase.html
> 
> And because, as Earl said, they have been using this technology before they were even related to NDS.
> 
> HERE WE GO A BETTER LINK
> 
> http://directv.com/DTVAPP/aboutus/headline.jsp?newsId=03_16_2004A


So does VideoGuard reencrypt the content on the HD? It doesn't encrypt all data and everything other than the data streams seem to be easy to read.


----------



## carl6

Wolffpack said:


> Did you try swapping the cards and the same time swapping the drives?


No, left the cards alone. Thought about it briefly, but decided not to. I know the cards are associated with the receiver ID number, so assumed they would not work if swapped, and was not going to pursue it to the point of calling D* and trying to get card x associated with receiver y.

Carl


----------



## Earl Bonovich

The later trend of this thread has started to teater into the grey area between constructive discussion and "areas we don't want to go"

So... to play more on the cautious side... I am going to close the thread.

We need tread lightly when it comes to discussions about how the security mechanisms of DirecTV work.

Earl


----------

