Page 1 of 3 123 LastLast
Results 1 to 15 of 31

Thread: Packet dump needed of MRV transfer

  1. #1
    Join Date
    Jun 2004
    Posts
    7

    Packet dump needed of MRV transfer

    Can someone with MRV(two Series3/HD, not series2 for the moment) please post or email me a packet dump of the first few seconds(including initialization) of an MRV transfer? I aim to develop an MRV emulator for the PC so that transfers will go much faster than TTG. If you want to email me the dump, email 1337mail [atatatat] gmail [dotdotdot] com.

    Thanks,
    Mike

  2. #2
    Join Date
    Nov 2007
    Posts
    7
    Some packet sniffing prompted by you revealed the following:
    MRV transfers can be initiated from a PC very similar to TTG transfer but with the addition of video format specification at the end. For example:
    Code:
    http://192.168.1.101/download/Grey's%20Anatomy.TiVo?Container=%2FNowPlaying&id=1169277&Format=video%2Fx-tivo-raw-tts
    Note the format specification at the end: &Format=video%2Fx-tivo-raw-tts
    (%20=space %2F=/)

    While this is all well and good and avoids having the Tivo have to re-mux and re-encrypt and hence speeds up transfers to MRV speeds, the question is what can be done with the resulting encrypted transport stream file on the PC?
    Last edited by moyekj; 11-13-2007 at 04:20 AM.

  3. #3
    Join Date
    Nov 2002
    Posts
    1,077
    Quote Originally Posted by moyekj View Post
    Some packet sniffing prompted by you revealed the following:
    MRV transfers can be initiated from a PC very similar to TTG transfer but with the addition of video format specification at the end. For example:
    Code:
    http://192.168.1.101/download/Grey's%20Anatomy.TiVo?Container=%2FNowPlaying&id=1169277&Format=video%2Fx-tivo-raw-tts
    Note the format specification at the end: &Format=video%2Fx-tivo-raw-tts
    (%20=space %2F=/)

    While this is all well and good and avoids having the Tivo have to re-mux and re-encrypt and hence speeds up transfers to MRV speeds, the question is what can be done with the resulting encrypted transport stream file on the PC?
    Wow, lacking a working MRV setup I had tried to guess the HTML post command that would get x-tivo-raw-tts but hadn't quite manged. See here:
    http://dealdatabase.com/forum/showpo...8&postcount=46

    Now, I took a look at what is extracted when one modifies the HTML POST as you found, and the resulting file is *not* encrypted! In fact it looks a lot like the raw mpeg2 transport stream content that s3tots processes. If you attempt playback with xine you'll see that it can almost play the video&audio streams as-is.

    So the idea here:

    http://dealdatabase.com/forum/showpo...5&postcount=58

    was on the money...
    Guess it's time to see if s3tots can be made to clean up this new file format.
    Last edited by bcc; 11-14-2007 at 02:13 AM.

  4. #4
    Join Date
    Nov 2002
    Posts
    1,077
    Quote Originally Posted by bcc View Post
    Now, I took a look at what is extracted when one modifies the HTML POST as you found, and the resulting file is *not* encrypted! In fact it looks a lot like the raw mpeg2 transport stream content that s3tots processes. If you attempt playback with xine you'll see that it can almost play the video&audio streams as-is.
    Note that I have the no encryption patch in my tivoapp. Maybe someone else could verify whether or not the recordings are scrambled without the tivoapp patch.

  5. #5
    Join Date
    Nov 2007
    Posts
    7
    Quote Originally Posted by bcc View Post
    Note that I have the no encryption patch in my tivoapp. Maybe someone else could verify whether or not the recordings are scrambled without the tivoapp patch.
    Mine definitely seems encrypted extracted from a non-hacked S3. I have not found any app that can recognize it - Womble, VLC, TSReaderLite, etc. all do not recognize the file. Direct Show Dump doesn't know what to do with it. Tivo Decoder UI does something with it but crashes about 1/4 of the way through and the resulting file it spits out is not anything recognizable either (probably because it expects program stream instead of transport stream).

    Did you verify that the modified transfer is indeed about 2x faster than normal TTG transfer? (Not much point pursuing this too much if the speedup is not significant enough).
    Last edited by moyekj; 11-14-2007 at 03:00 AM.

  6. #6
    Join Date
    Nov 2002
    Posts
    1,077
    Quote Originally Posted by moyekj View Post
    Mine definitely seems encrypted extracted from a non-hacked S3. I have not found any app that can recognize it - Womble, VLC, TSReaderLite, etc. all do not recognize the file. Direct Show Dump doesn't know what to do with it. Tivo Decoder UI does something with it but crashes about 1/4 of the way through and the resulting file it spits out is not anything recognizable either (probably because it expects program stream instead of transport stream).
    vlc doesn't read mine either. You need to test with a player that is really permissive about the mpeg streams (it'll search for the headers when they are not where they should be). Have you tried xine or mplayer?
    Quote Originally Posted by moyekj View Post
    Did you verify that the modified transfer is indeed about 2x faster than normal TTG transfer? (Not much point pursuing this too much if the speedup is not significant enough).
    No I haven't checked. A point would be that with this method, one could bypass use of mfs_ftp/tserver&mfs-utils and extract with stock software on their tivo (without any pesky DRM added to the recording).
    Last edited by bcc; 11-14-2007 at 03:12 AM.

  7. #7
    Join Date
    Nov 2007
    Posts
    7
    Just tried mplayer - no dice. "Cannot seek backward in linear streams! Seek failed Exiting... (End of file)" I'm very sure I have an encrypted file. I've dealt a lot with mpeg2 transport streams and in it's current form this file is not it.

  8. #8
    Join Date
    Nov 2002
    Posts
    1,077
    Ok, so I benchmarked regular TTG vs TTG with x-tivo-raw-tts. With regular TTG:
    .tivo file of 620864088 bytes, 405 seconds to extract. That's 11Mbit/sec. Transfer rate was pretty constant during the download as well.

    With x-tivo-raw-tts:
    ts file of 647653868 bytes, 142 seconds. That's 35Mbit/sec. Ditto the constant transfer rate.

    So we finally have some performance results that quantify just the overhead of adding the Qualcomm cipher to the recordings. Wow, that's a big performance hit.

  9. #9
    Join Date
    Nov 2007
    Posts
    7
    Quote Originally Posted by bcc View Post
    Ok, so I benchmarked regular TTG vs TTG with x-tivo-raw-tts. With regular TTG:
    .tivo file of 620864088 bytes, 405 seconds to extract. That's 11Mbit/sec. Transfer rate was pretty constant during the download as well.

    With x-tivo-raw-tts:
    ts file of 647653868 bytes, 142 seconds. That's 35Mbit/sec. Ditto the constant transfer rate.

    So we finally have some performance results that quantify just the overhead of adding the Qualcomm cipher to the recordings. Wow, that's a big performance hit.
    That's very good info. If you tune both tuners of your S3 to channels you don't receive for the duration of the transfer you can speed it up even more to about 44Mbit/sec or so. I would assume you can monitor Tivo resources in use (perfmeter or "top" style monitoring) and can determine that the transfer is still CPU limited?

    So looks like very little chance of this benefiting users with unhacked Tivos? Personally I don't have the skills necessary for the PROM hack and wouldn't feel comfortable letting someone else do the hack either. Any other way?
    Last edited by moyekj; 11-14-2007 at 05:06 AM.

  10. #10
    Join Date
    Nov 2002
    Posts
    1,077
    Quote Originally Posted by moyekj View Post
    That's very good info. If you tune both tuners of your S3 to channels you don't receive for the duration of the transfer you can speed it up even more to about 44Mbit/sec or so. I would assume you can monitor Tivo resources in use (perfmeter or "top" style monitoring) and can determine that the transfer is still CPU limited?
    My benchmark was with an s3 with both tuners tuned to channels I don't receive, and the system was in standby. Net connection was via built-in ethernet, stock MTU, stock kernel, and gig-e switch to a gig-e host.
    Quote Originally Posted by moyekj View Post
    So looks like very little chance of this benefiting users with unhacked Tivos? Personally I don't have the skills necessary for the PROM hack and wouldn't feel comfortable letting someone else do the hack either. Any other way?
    Well I haven't verified that TTG leaves the recording scrambled with x-tivo-raw-tts without a tivoapp change. What I see are headers before every ~128K of payload so you might just be having problems with your players being confused by those headers.

    If it is in fact true that extractions remain scrambled, the weak link might be to figure out how to get the equivalent of unscramble.o working on a PC. You can feed the scrambler content via TTCB so it might not require getting a secret out of the crypto chip.

  11. #11
    Join Date
    Nov 2002
    Posts
    1,077
    Quote Originally Posted by bcc View Post
    If it is in fact true that extractions remain scrambled,
    Ok, I looked & agree they're scrambled when tivoapp isn't patched (except for the header info).

  12. #12
    Join Date
    Aug 2004
    Posts
    4,086
    Quote Originally Posted by bcc View Post
    ...
    So we finally have some performance results that quantify just the overhead of adding the Qualcomm cipher to the recordings. Wow, that's a big performance hit.
    Is it really just the qualcomm cipher? Isn't there a remux involved in a non-raw TTG transfer that is being skipped with raw?

  13. #13
    Join Date
    Jan 2002
    Location
    Sonoran Desert
    Posts
    2,829
    Quote Originally Posted by moyekj View Post
    Just tried mplayer - no dice. "Cannot seek backward in linear streams! Seek failed Exiting... (End of file)" I'm very sure I have an encrypted file. I've dealt a lot with mpeg2 transport streams and in it's current form this file is not it.
    Open the downloaded file with a hex editor and look at the first two bytes. If they aren't the same as a normal unencrypted stream, then it is definitely encrypted. I don't know if these newer streams have a different magic number, otherwise I would tell you what it is.
    Before PMing me: Iím not your personal tech support. If you have a question, ask in public so I don't have to repeat if somebody else asks. If you want images or slices, use emule. I will ignore all support PMs.

    Sponsor a vegetarian! I have taken the pledge, how about you?

  14. #14
    Join Date
    Aug 2004
    Posts
    4,086
    Quote Originally Posted by AlphaWolf View Post
    Open the downloaded file with a hex editor and look at the first two bytes. If they aren't the same as a normal unencrypted stream, then it is definitely encrypted. I don't know if these newer streams have a different magic number, otherwise I would tell you what it is.
    The "magic" number is the same (see drmcheck.tcl). It might not be the first two bytes in the data stream, depending on what other metadata is being sent with the raw ty data.

    This could still be useful on a hacked tivo. It's a way of extracting without need the vagaries of mfs_ftp. It also could be useful on an unhacked tivo if we could at least send it back to the tivo to play it. Of course, I assume the copy protection bits restrict what you can extract via http, while you have no so restrictions with mfs_ftp.

  15. #15
    Join Date
    Nov 2002
    Posts
    1,077
    Quote Originally Posted by Jamie View Post
    Is it really just the qualcomm cipher? Isn't there a remux involved in a non-raw TTG transfer that is being skipped with raw?
    Oh right, there would be the mpeg2 transport stream to program stream conversion as well. But that should be computationally fairly easy - more like reformatting the streams than re-muxing. The program stream is already muxed at the correct rate and with all the timestamps. For reference, notice how quickly videoredo can perform a ts->ps rewrite.

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •