Results 1 to 12 of 12

Thread: iPad interface discovery?

  1. #1
    Join Date
    Dec 2010
    Location
    Delray Beach, Florida
    Posts
    6

    iPad interface discovery?

    So, I don't actually want to hack my tivo Premier, but I would love to discover all the things about it that tivo won't seem to tell anyone. In particular, it apparently supports a rather complete remote interfacing protocol in order to implement the iPad app that tivo is heavily promoting now (even though you can't actually get the app yet :-). I'd love to implement my own control app for linux so I could talk to the tivo while on my computer. Are these forums likely to be the place to discover information about such protocols (if anyone figures them out)?

  2. #2
    Join Date
    Jun 2003
    Posts
    611
    Are they using the UI Control via Telnet interface perhaps?

    http://www.dealdatabase.com/forum/sh...ad.php?t=59068

    -psxboy
    TCD652160 TivoHD
    1TB
    11.0n.J1-01-2-652

  3. #3
    Join Date
    Dec 2010
    Location
    Delray Beach, Florida
    Posts
    6
    Quote Originally Posted by psxboy View Post
    Are they using the UI Control via Telnet interface perhaps?

    http://www.dealdatabase.com/forum/sh...ad.php?t=59068

    -psxboy
    I've seen that, but unless there is a lot more that is undiscovered about it, they
    probably have something completely different. Except for the live TV in the corner,
    the iPad interface looks just like all the tivo menus (from the pictures on tivo's
    web site anyway), so they are getting lots of feedback about the current tivo
    programs and wot-not, not merely sending control codes.

    I did see tivo was named in a silly lawsuit about using the SOAP protocol
    (which would be something that would work quite well to provide the info for the
    iPad screen).

  4. #4
    Join Date
    Feb 2004
    Location
    New York City
    Posts
    577
    Does the iPad interface only work on the same network or does it work over the internet? I was under the impression it uses the same protocol used by TiVo for the "real time connection" that lets you schedule shows or modify season passes online. If it does, I'm guessing that connection is encrypted, although I've never really looked.

  5. #5
    Join Date
    Dec 2010
    Location
    Delray Beach, Florida
    Posts
    6
    Quote Originally Posted by Thinkdiff View Post
    Does the iPad interface only work on the same network or does it work over the internet?
    According to the tivo web site, it works locally or remotely. It also says you need to activate the "allow network remote control" in the setting page, which is the same setting that enables the telnet interface, so maybe it is using telnet, but just has a lot more in the interface now.

    The tivo pages also say you need to login two different ways depending on local or remote access, so it seems like it has two totally different schemes for different kinds of access.

    I did an nmap port scan of the tivo the other day, I should try it again with the network control disabled and see if any ports other than 31339 disappear from the port scan. That might be a clue :-).

  6. #6
    Join Date
    Dec 2010
    Location
    Delray Beach, Florida
    Posts
    6
    Quote Originally Posted by Kakapo View Post
    I did an nmap port scan of the tivo the other day, I should try it again with the network control disabled and see if any ports other than 31339 disappear from the port scan. That might be a clue :-).
    Just tried it. With network remote enabled I see:

    PORT STATE SERVICE
    80/tcp open http
    443/tcp open https
    1390/tcp open iclpv-sc
    2190/tcp open unknown
    2191/tcp open unknown
    8430/tcp open unknown
    31339/tcp open unknown

    Disabling network remote produces the same list with port 31339
    closed.

    Port 8430 is interesting. I've never seen any mention of it with tivo (and apparently
    neither has google).

  7. #7
    Join Date
    Jun 2003
    Posts
    611
    This is just a guess, but it looks like the app uses a combination of things to control the Tivo and get information about shows, etc. It's likely a native implementation of the Premiere UI, downloading guide data and show info from Tivo.com, Now Showing & ToDo & season pass info via the Tivo's web interface (or possibly from your account at Tivo.com), and using the telnet control interface to execute actions on the Tivo itself.

    It would be interesting to see (once it's available) what "breaks" when you restrict internet access from the iPad but still allow it access to the Tivo on the local network.

    -psxboy
    TCD652160 TivoHD
    1TB
    11.0n.J1-01-2-652

  8. #8
    Join Date
    Dec 2010
    Location
    Delray Beach, Florida
    Posts
    6
    I've got the 14.7 update which is apparently required to support the iPad app, and a new portscan shows some new open ports:

    PORT STATE SERVICE
    80/tcp open http
    443/tcp open https
    1390/tcp open iclpv-sc
    1393/tcp open iclpv-nls
    1400/tcp open cadkey-tablet
    1410/tcp open hiq
    1413/tcp open innosys-acl
    2190/tcp open unknown
    2191/tcp open unknown
    8430/tcp open unknown
    31339/tcp open unknown

    Maybe those 1400, 1410, and 1413 ports are used by the app?

  9. #9
    Join Date
    Dec 2010
    Location
    Delray Beach, Florida
    Posts
    6
    And apparently the ipad app is now available. Anyone with an iPad, a tivo, and a router than can gather tcpdumps of the activity between them?

  10. #10
    Join Date
    Sep 2004
    Location
    Los Angeles
    Posts
    71
    Here are 2 captures of the traffic between the iPad and Tivo. It uses MDNS to discover Tivos on the network and then the iPad opens a socket to port 1393 on the Tivo. The messages appear to be unencrypted binary.
    I have 4 Tivos. Is that too many?

  11. #11
    Join Date
    Sep 2009
    Posts
    2

    29

    It's not 'unencrypted binary' as each packet's data starts with the same content, the SSL header. Most protocols use plaintext as the method of choice to send data. The TiVo uses the MRPC protocol, just using SSL encryption. I actually went as far as to disable SSL inside the app's binary, and although this disables the app from working, I captured the first request it sends to the TiVo, unencrypted:

    Code:
    MRPC/2 224 85
    Type:request
    RpcId:4
    SchemaVersion:7
    Content-Type:application/json
    RequestType:bodyAuthenticate
    ResponseCount:single
    BodyId:
    X-ApplicationName:Quicksilver
    X-ApplicationVersion:1.2
    X-ApplicationSessionId:0x3bc3f0
    
    {"type":"bodyAuthenticate","credential":{"type":"makCredential","key":"XXXXXXXXXX"}}
    EDIT: I seem to have broken the code, I can now get all requests before they are sent out in the app (i.e. unencrypted). It seems MRPC is a very configurable protocol, you specify a request type (recordingSearch, subscriptionSearch, contentSearch, offerSearch, and collectionSearch are the common ones I see), and then specify what you want to search for, and also how you want to receive the results. All in JSON. An example request to get all your season passes:

    Code:
    MRPC/2 246 651
    Type:request
    RpcId:37
    SchemaVersion:7
    Content-Type:application/json
    RequestType:subscriptionSearch
    ResponseCount:single
    BodyId:tsn:XXXXXXXXXXXXXXX
    X-ApplicationName:Quicksilver
    X-ApplicationVersion:1.2
    X-ApplicationSessionId:0x3a82a0 (Unique, random number, probably based on time, that remains the same per one authentication session)
    	
    {"type":"subscriptionSearch","noLimit":true,"bodyId":"tsn:XXXXXXXXXXXXXXX","levelOfDetail":"medium","responseTemplate":[{"type":"responseTemplate","fieldName":["subscription"],"typeName":"subscriptionList"},{"type":"responseTemplate","fieldName":["title","subscriptionId","idSetSource","maxRecordings","showStatus","keepBehavior"],"typeName":"subscription"},{"type":"responseTemplate","fieldName":["title","contentId","channel","startTime","duration","hasSignLanguage","hasAudioDescription","screenFormat","offerId","cc","collectionId"],"typeName":"offer"}],"objectIdAndType":["581641651188047","581641651188014","581641651187883","581641651187995"]}
    Overall:
    You send an authentication request to your TiVo on port 1413 (for my TiVo, does it vary per TiVo?) with your MAK, encrypted with SSL. Then you send any request you want to obtain the data you want. I will probably provide a more in depth dissemination of the protocol and some sample code in perl soon.
    Last edited by ckrames1234; 05-01-2011 at 12:14 PM. Reason: Added code tags

  12. #12
    Join Date
    Mar 2008
    Posts
    1
    FWIW, there's a thread at TiVo Community Forum with proof of concept python scripts, provided by TCF member arantius:

    http://www.tivocommunity.com/tivo-vb...d.php?t=462980

    and more specifically, the posts with python script links:

    http://www.tivocommunity.com/tivo-vb...86#post8553686
    and
    http://www.tivocommunity.com/tivo-vb...32#post8565132

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •