Hallo,

at first I want to thank you for this very interesting thread. I have 
also one question. I am facing with the problem of lack of video output 
selection in VIP 1963 STB (from KPN, currently running by my local 
operator). Similar to you. By the other hand I have older VIP 1960 with 
this menu available in firmware. Do you know any workaround for this 
issue?

Best Regards

Thank you for your reasearch. Great work!

Three questions:

Can the image be used for the Motorola VIP 19x3 boxes (aka 1963)?
And how to get the image on the box?

Does anyone know where the console points are on a 1963?
I suspect at the edge, right-bottom (facing the front) but it seems to 
do nothing.

Can the box be used after flashing for regular use? (Aka subscribed tv)
Or is there a way to make a bootloader with telnet enabled only and grab 
the current image from the box?

Can you provide a quick setup?

Attach box to network.
Start infocastools and broadcast image from above

I probably have to to do something else here...

Put box in updatemode (Press menu when booting up)?
(Change parameters to suit the server providing image?)
Press update..


Correct me and add where neccesary.

Martin, you are using a vip1960 right? with serial console (edge right 
bottom) Is there a way in the official firmware to stream the tv image 
out of the box when having serial access? I am thinking of buying a 
Vip1960 just for this purpose.

Idea:

find old bootloader with console access. Put it on the box.
Block updates from KPN to bootloader (but let it download for future 
references)
Let the box update the other parts (kernel, middleware userland)
You think that would work?

Stream a tv channel across my network. I am subscribed.

Oroginal streams are verimatrix encrypted, I sniffed the traffic between 
VIP and server but there's no firmware. just config list, channel list 
and boot options list. I could try to spoof the boot options list since 
telnet is an option. (I read the manual) Will see whether that works.

The reason for the telnet/serial access was to put some streaming client 
on the device without the need for decryption keys since the box does a 
good job on those :-)

thanks for that. How to get the certificate without some kind of access 
access to the box?
I am missing a step I think. There's something listening on port 9001 
but telnet does not show any banners.

Or perhaps you mean just put "your" software on the box and it will 
still work since it's based on mac and decryption is still done inside 
box because of rootcert is still in the box?

Oh Well, for those who are interested:

First, the box downloads an index file (RTSP encoded plaintext file)
<ip-of-server>/index/mac-adress-of-box)
Content:
---
vqec-network-cfg <md5 sum of settings file to be downloaded>
vqe-channels <md5 sum of channellist file to be downloaded>
---

Then another RTSP encoded plaintext file called vqec-network-cfg
<ip-of-server>/vqec-network-cfg/mac-adress-of-box)
- This one holds the settings for the box (If different as stored in 
flash)
Then final RTSP encoded plaintext file called vqe-channels
<ip-of-server>/vqe-channels/mac-adress-of-box)
- This one holds the channels and their IP and ports etc etc.

If you can the box into thinking that it loads a valid (but modified) 
vqec-network-cfg with telnet enabled then you can get access to the box.

I can try if I can do that with tcpreplay or another pcap injection 
software.

(Command to inject to cfg file is: libcli_telnet_port = 1; )

Martin,

do you know (or can you check) how to insert ab-c-d-e etc. characters 
with the remote? When the device boots and you press menu...and 
afterwards 2357 (Ip settings) and 7532(advanced menu) You can change 
boot order, netconsole ip, tftp ip, http ip, boot filename, splash 
filename...etc.etc. But I need to insert characters. Any Idea?

By the way:

splash protocol 313 meand 3 (Bootcast, Local Image, Bootcast)

Change with: arrow back/? button (delete)

1. Local image
2 TFTP
3 Bootcast
4 HTTP

(I guess, 2 is definately Bootcast and 2 definately tftp)

scroll down (channel down) to see other options like enable adavaced 
menu? (No default) Uhmm how to change it to Yes is what is the problem. 
(not that it cannot be done but you have to change it to "Yes" and only 
available option is 123456789

I am a fool

313 (3 Bootcast, 1 Local image, 3 bootcast)

Anyway, you get the idea.

Right, i downloaded the firmware onto the box with tftp.
Everyting went ok. I got a white screen but that's because I have to put 
in the portal used. (Have to find out about that) telnet and ssh worked.
No I want to download the original software somehow by using your image.
Any idea what command to use to do that? I know the server, SAP adress 
port etc. etc.

Martin,

/proc/kboxbch
/proc/kboxparam
/proc/kboxuserparam

are holding those menu settings..you can change them by hand if you or 
me can find a way to make it writable (it's Readonly at the moment)

I have an Xs4all line, basically an KPN line. It has another server for 
downloading the fw. But when you look in the debug you can find the 
server it tries to connect with. (if you have the original fw on the 
box)

Since infocast tools are freaking out my computer (maybe use a linux one 
for this) I tried streaming media monitor which detects something but 
nothing usefull. Anyway, fo a 1963 the server is

Listening on SAP channel 224.3.2.6:9875
Searching for splash session splash.motorola.vip1963...
Searching for kernel session bootstrap.motorola.vip1963...
SAP: Image download attempt 1 of 1
Loading splash image from address 224.0.250.82:64082...
Retrieving network splash version from SAP...
<snap>
SAP: Image download attempt 1 of 3
Loading kernel image from address 224.0.250.118:64118...

Martin,,

do you know how to mount the <stored image> in the flash? (Or do you 
know the mountpoint/start address?) I can load your image via tftp in 
memory but I want to mount the original rootfs which is on the box.

Infocast is not going to work since it's using sap btw. (If you can 
program in C you can get the full desciption out of the 
bootloader-toolchain)

Found it, it's called .bootimage on the /flash
So that should be the stored image. Now find a way to extract the rootfs 
out of it. After that it can simply be mounted. (I think)

Thanx for the duff site. It's probably only for 17xx boxes. Search for 
the key will continue since my box isn't secured, althought the software 
(hex) says SEC. And you can have secured without encrypted and signed. 
(they say)

Btw. If you use a DHCP server with the right options you can override 
parameters. It happens when I connect to the DSL line and use their DHCP 
server.. You can find DHCP options in 
kreatv-doc-sdk-user-manual_4.3.IAP30.3.tgz and examples, maybe this 
helps.

I will try to send the spanish guy some (c file) info on the sap 
structure, I gained it from the bootloader, Motorola licensed it under 
GPL.

I 've written them a small message to release the OSS bootloader for the
19x0/19x3 family of stb's. Let's see what they have to say.

Did you sig or encrypted your version of the software Martin?

Beste Martin,

Om hier even offtopic iets te vragen.

Is het mogelijk om een overgekochte vip1853 werkend te krijgen. Dit als 
2e ontvanger bij telfort. De ontvanger download z n software komt 
uiteindelijk met de melding: Geblokkeer​d Uw account is geblokkeer​d. 
Dus het lijkt erop dat de gegevens van de vorige gebruiker er nog op 
staan.

How to fix this?

Gr Jan

Beste Martin,

Dit werkt niet. Er komt geen vraag voor abonnementsnummer en code.

Is het eventueel mogelijk om deze ontvanger een ander mac adres te 
geven?

Mvg Jan

When i reset en factory default the box. I turn one Receiver off. Then i 
connect the other one. It comes up downloads it's software. Then the 
message apears: Blocked, Account is locked out, contact HD.

So it looks like the receiver is blocked in the Netwerk of the Service 
Provider. If it is still in the profile of the other user (on the site 
of the Service Provider) Will it come up also with this message?

Is it possible to change mac and serial number anyway?

Greetz

Reset the box to factory settings won't do the job. Serial number or Mac 
or some key identifier will identify it subscriber as valid/invalid on 
Telforts/KPN/other-provider server. You have to call them to release the 
box.

Thanks Martin,

I had figured it out. But the HD of Telfort or KPN won't release the 
box. So thats not going to help.

Thanks Anyway

"Without special tools from Motorola it isn't possible right now to 
change MAC/Serial" 

I left a message on the Motorola Forum that they are violating the GPL 
by not releasing the oos bootloader code. If we have that one we can 
figure soemthing out.

I found a strange key sequence in the Kreatel 1710 bootloader.

static enum remote_key fb_console_code[] =
  { KEY_5, KEY_5, KEY_7, KEY_7, KEY_7, KEY_3, KEY_3,
    KEY_2, KEY_8, KEY_3, KEY_3, KEY_5, KEY_5, KEY_5, KEY_0,
    KEY_3, KEY_3, KEY_3, KEY_2, KEY_2, KEY_8, KEY_8, KEY_4 }; 

fb...framebuffer? Console? Any clue?

Btw, KPN is not using a "portal". The complete userinterface with 
screens is written in Java (and with espial webkit/browser). (And not 
secured) I can make it crash (by using a normal keyboard) but then the 
UI restarts. If you want to play with it, i can post the archive if 
anyone wants that.

Hello,

I have one VIP1960 that cannot be used for now. I power the box and it 
waits the connection to server. How can i get some custom software on 
it? I want to use it to receive some streams from my streaming server.

How can i do this ?
Thanks!

Boot the VIP1960 (Powered off..unplug it)

Keep  pressing the "menu" button while booting. You 'll see a blue 
screen with some info. Press 2357 for IP Settings and Press 7532 for 
changing bootsequence and tftpserver. (For tftpserver boot change 
bootsequence to 23
2 is tftp...3 is boot from flash

Sourcecode for 19x3 and 190x and 185x is released by Motorola btw.

http://sourceforge.net/projects/vip19x0.motorola-home/files/

Hi guys,

Anything new?
How can get into this box and get the command line on my screen ?
I still have the box on hold...
I set a static IP to the box but i cannot ping it...
Maybe a short tutorial for breaking into this and connect it to my 
network to play some streams from my pc ?

I appreciate your work and i wish to help you as much as I can.

Marian

Need some help finding Infocast server software

hi all i have a problem with my motorola i use image download over HTTP 
all services work fine my problem is the time on stb is 1.1.1970 and the 
clock is 0:00 any can halp me hov to resolve this problem i dont like to 
use infocast server

how can i see this i haw configure the NTP server bat dont have corect 
time is it a way to configure it manual or how can i create a image i 
use BeeSmart platform with ekioch browser and i use the image from 
infocast server

for conection with server i use this script on my HTTP Server



 <?xml version="1.0"?>
<!DOCTYPE StbConfig SYSTEM "stbconfig.dtd">
<StbConfig>
<BootParams>
<KernelUrl>http://ServerIP:85/image/kreatv-bi-beesmart_1xx3.b...
<KernelVersion>3.0</KernelVersion>
<SplashUrl>http://ServerIP:85/image/motorola-splash-pal_1900....
<SplashVersion>3.0</SplashVersion>
</BootParams>
<StbConfig>

the portal url i inser manual over Telnet
using this comand

toish is SetObject config.ekioh.homepageurl http://my 
ServerIP:85/omniplay/client/index.svg permanent

BusyBox v1.13.3 (2010-02-12 17:22:36 CET) built-in shell (ash)
Enter 'help' for a list of built-in commands.

/ # toish is getobject all
[Volatile]
_dhcp.serverid: 192.168.1.1
_dhcp.sroutes:
stat.infocast.0.time.total: 2952
stat.infocast.0.totalbytes: 0
stat.infocast.0.totalpackets: 0
stat.infocast.0.url: opch://224.2.2.2:22222
var.io.state: normal
var.ip._dhcp.240:
var.ip._dhcp.241:
var.ip._dhcp.242:
var.ip._dhcp.243:
var.ip.dns1: 192.168.1.1
var.ip.dns2: 192.168.1.1
var.ip.eth0.addr: 192.168.1.3
var.ip.eth0.link: true
var.ip.eth0.mask: 255.255.255.0
var.ip.gateway: 192.168.1.1
var.standby.mode: false
var.system.mode: false

[FlashUser]
[Production]
_fw.cfg.ip.eth0.mode: DHCP
cfg.locale.vendorid: Motorola_VIP1003
cfg.media.tv.colorsystem: PAL
cfg.media.tv.output: RGB
config.architecture.bootcastid: motorola-vip1003
config.architecture.bootimagecompatibility: 29
config.architecture.dblcompatibility: 29
config.productdisplayname: Motorola VIP1003
config.productname: VIP1003
const.capabilities.decoder.avc: false
const.capabilities.dtt: false
const.capabilities.hdmi: true
const.capabilities.macrovision: false
const.capabilities.rf: false
const.fw.region: emea
const.hw._dsp:
const.hw._dvbnim:
const.hw._hdmi: Yes
const.hw._mainprocessor:
const.hw._rfmodulator:
const.hw.manufacturer: Motorola
const.hw.productname: vip1003
const.hw.serialnumber: M91245EGF152
const.hw.version: 583711-001-00

[FlashFs]
cfg.media.audio.formatpriority: MPEG,AC3,HE_AAC_STEREO,HE_AAC_SURROUND
cfg.migration.v3_x_done: TRUE
cfg.tvoutput.audioconfig: <?xml version="1.0" ?>
<AudioOutputSettings version="1">
        <connection type="AUDIO_CONNECTION_TYPE_ANALOG" index="0" 
volume="100" l
atency="0">
                <mapping from="AUDIO_FORMAT_MPEG_1" 
to="AUDIO_FORMAT_PCM_2CH" mi
x="0"/>
                <mapping from="AUDIO_FORMAT_MPEG_2" 
to="AUDIO_FORMAT_PCM_2CH" mi
x="0"/>
                <mapping from="AUDIO_FORMAT_AC3" 
to="AUDIO_FORMAT_PCM_2CH" mix="
0"/>
                <mapping from="AUDIO_FORMAT_AC3_PLUS" 
to="AUDIO_FORMAT_PCM_2CH"
mix="0"/>
                <mapping from="AUDIO_FORMAT_AAC_HE" 
to="AUDIO_FORMAT_PCM_2CH" mi
x="0"/>
                <mapping from="AUDIO_FORMAT_AAC_LC" 
to="AUDIO_FORMAT_PCM_2CH" mi
x="0"/>
                <mapping from="AUDIO_FORMAT_PCM_2CH" 
to="AUDIO_FORMAT_PCM_2CH" m
ix="0"/>
        </connection>
        <connection type="AUDIO_CONNECTION_TYPE_SPDIF" index="0" 
volume="0" late
ncy="0">
                <mapping from="AUDIO_FORMAT_MPEG_1" 
to="AUDIO_FORMAT_PCM_2CH" mi
x="0"/>
                <mapping from="AUDIO_FORMAT_MPEG_2" 
to="AUDIO_FORMAT_PCM_2CH" mi
x="0"/>
                <mapping from="AUDIO_FORMAT_AC3" 
to="AUDIO_FORMAT_PCM_2CH" mix="
0"/>
                <mapping from="AUDIO_FORMAT_AC3_PLUS" 
to="AUDIO_FORMAT_PCM_2CH"
mix="0"/>
                <mapping from="AUDIO_FORMAT_AAC_HE" 
to="AUDIO_FORMAT_PCM_2CH" mi
x="0"/>
                <mapping from="AUDIO_FORMAT_AAC_LC" 
to="AUDIO_FORMAT_PCM_2CH" mi
x="0"/>
                <mapping from="AUDIO_FORMAT_PCM_2CH" 
to="AUDIO_FORMAT_PCM_2CH" m
ix="0"/>
        </connection>
        <connection type="AUDIO_CONNECTION_TYPE_HDMI" index="0" 
volume="0" laten
cy="0">
                <mapping from="AUDIO_FORMAT_MPEG_1" 
to="AUDIO_FORMAT_PCM_2CH" mi
x="0"/>
                <mapping from="AUDIO_FORMAT_MPEG_2" 
to="AUDIO_FORMAT_PCM_2CH" mi
x="0"/>
                <mapping from="AUDIO_FORMAT_AC3" 
to="AUDIO_FORMAT_PCM_2CH" mix="
0"/>
                <mapping from="AUDIO_FORMAT_AC3_PLUS" 
to="AUDIO_FORMAT_PCM_2CH"
mix="0"/>
                <mapping from="AUDIO_FORMAT_AAC_HE" 
to="AUDIO_FORMAT_PCM_2CH" mi
x="0"/>
                <mapping from="AUDIO_FORMAT_AAC_LC" 
to="AUDIO_FORMAT_PCM_2CH" mi
x="0"/>
                <mapping from="AUDIO_FORMAT_PCM_2CH" 
to="AUDIO_FORMAT_PCM_2CH" m
ix="0"/>
        </connection>
        <connection type="AUDIO_CONNECTION_TYPE_DECODER" index="0" 
volume="100"
latency="0">
        </connection>
</AudioOutputSettings>

cfg.video.color_system: PAL-B
cfg.video.component_mode: OFF
cfg.video.hdmi_color_space: sRGB
cfg.video.hdmi_mode: EDTV
cfg.video.tv_scart_mode: CVBS
config.ekioh.homepageurl: http://MyServerIP:85/omniplay/client/index.svg
config.tvoutput.videooutputconfiguration: <?xml version="1.0"?>
<VideoOutputConfiguration version="1">
  <ColorSystem>COLOR_SYSTEM_PAL_B</ColorSystem>
  <ScartLoopThrough>NO_VALUE_MODE</ScartLoopThrough>
  <Outputs>
    <Output>
      <Id>0</Id>
      <ConnectionType>VIDEO_CONNECTION_TYPE_HDMI</ConnectionType>
      <Mode>VIDEO_MODE_576P50</Mode>
      <ColorSpace>DIGITAL_COLOR_SPACE_SRGB</ColorSpace>
    </Output>
    <Output>
      <Id>2</Id>
      <ConnectionType>VIDEO_CONNECTION_TYPE_SCART</ConnectionType>
      <ScartMode>SCART_MODE_CVBS</ScartMode>
    </Output>
  </Outputs>
</VideoOutputConfiguration>

info.ffs.periodtimestamp: 946684822
info.ffs.periodwritecount: 1
info.ffs.totalwritecount: 3

[Infocast]
var.ip.metachannel: 224.2.2.2:22222

[Os]
config.architecture.target: vip1903
config.portalarea.height: 576
config.portalarea.width: 720
config.safearea.height: 490
config.safearea.width: 612
config.screenarea.height: 576
config.screenarea.width: 720
config.visiblearea.height: 490
config.visiblearea.width: 612
config.visiblearea.x: 54
config.visiblearea.y: 43
const._fw.version: 3.17.2
const.capabilities.fp.display:
const.capabilities.fp.leds: 20
const.ip.eth0.mac: 00:02:9b:98:a5:da
var.memfree:
var.utctime:

[Default]
cfg.locale.keyboard: en-US+toggle_off
cfg.locale.timezone: UTC
cfg.locale.ui: en-US
cfg.media.sub.hoh: FALSE
cfg.media.tv.aspectratio: 4:3
cfg.media.tv.colorsystem: PAL
cfg.media.tv.output: Video
cfg.media.useprogramcache: TRUE
cfg.media.video.16_9method: None
cfg.media.video.4_3method: LetterBox
cfg.standby.allowupdate: TRUE
cfg.standby.kreatv_mode: 1
cfg.uilangs: en-US
cfg.video.hdmi_auto_activate: FALSE
cfg.video.hdmi_ignore_edid: TRUE
config.1staudiolanguage: eng
config.1stsublanguage: eng
config.2ndaudiolanguage: swe
config.2ndsublanguage: swe
config.audiocontrol: TRUE
config.channeltable:
config.defaultfontsize: 16
config.initialvolume: 80
config.minfontsize: 16
config.onscreenkeyboard: FALSE
config.onscreenkeyboarddelay: 1500
config.onscreenkeyboardmode: EXTENDED
config.onscreenkeyboardtoggle: FALSE
config.portalshowwebcontent: FALSE
config.scartarsignal: FALSE
config.soundmode: Analog
config.standbyled: TRUE
config.subtitling: TRUE
config.support.multicast: TRUE
config.uilanguage: eng
config.useragent:
const.capabilities.macrovision: FALSE
const.sw.branch:
const.sw.company: Motorola, Inc.
const.sw.configuration: beesmart
const.sw.date: 20110316
const.sw.host: rehel-sussa-test3
const.sw.time: 101246
const.sw.user: root
const.sw.version: 3.8.3.13

[RCU Event]
var.rcu.low_battery: false


/ #

Ich weis nicht wie man ein image kreiert ist es möglich das sie für mich 
eins machen were super ich habe nicht sehr fiel ahnung davon danke in 
foraus

Martin V. schrieb:
> toish is getobject all
>
> In my image it said
>
> 'const.time.available_sources: ntp'
>
> Because I've put 'kreatv-option-ntp' in my image.
>
> So you need to know what options are included in the image, often images
> comes with a text file which indicate what is included.
>
> Or search for the KreaTV SDK on the web and build your own image.

is it posible to giv me your image or can you create one for me
thenks