Topics

1

Software / DLNA client on silver BT vision box

17. Jul 2014, 20:52

If you boot into the secret menu, there is a "Personal Media Settings" option to "Enable playback from home network". If you do this, it will turn the silver BT Vision box into a DLNA upnp client! When you select "Photos music and video" from the secret menu, it will then look on your local network for a DLNA server.

The following network activity can be observed:

Code: [Select]

NOTIFY * HTTP/1.1
Host: 239.255.255.250:1900
Cache-Control: max-age=1800
Location: http://192.168.0.4:53208/upnp/1
NT: uuid:-----------------------------
NTS: ssdp:alive
Server: CESTB/6.1 UPnP/1.0 DMP/5.0
USN: uuid:-----------------------------
OPT: "http://schemas.upnp.org/upnp/1/0/"; ns=01

NOTIFY * HTTP/1.1
Host: 239.255.255.250:1900
Cache-Control: max-age=1800
Location: http://192.168.0.4:53208/upnp/1
NT: uuid:-----------------------------
NTS: ssdp:alive
Server: CESTB/6.1 UPnP/1.0 DMP/5.0
USN: uuid:-----------------------------
OPT: "http://schemas.upnp.org/upnp/1/0/"; ns=01

NOTIFY * HTTP/1.1
Host: 239.255.255.250:1900
Cache-Control: max-age=1800
Location: http://192.168.0.4:53208/upnp/1
NT: upnp:rootdevice
NTS: ssdp:alive
Server: CESTB/6.1 UPnP/1.0 DMP/5.0
USN: uuid:-----------------------------::upnp:rootdevice
OPT: "http://schemas.upnp.org/upnp/1/0/"; ns=01

NOTIFY * HTTP/1.1
Host: 239.255.255.250:1900
Cache-Control: max-age=1800
Location: http://192.168.0.4:53208/upnp/1
NT: upnp:rootdevice
NTS: ssdp:alive
Server: CESTB/6.1 UPnP/1.0 DMP/5.0
USN: uuid:-----------------------------::upnp:rootdevice
OPT: "http://schemas.upnp.org/upnp/1/0/"; ns=01

NOTIFY * HTTP/1.1
Host: 239.255.255.250:1900
Cache-Control: max-age=1800
Location: http://192.168.0.4:53208/upnp/1
NT: urn:schemas-upnp-org:device:MediaRenderer:1
NTS: ssdp:alive
Server: CESTB/6.1 UPnP/1.0 DMP/5.0
USN: uuid:-----------------------------::urn:schemas-upnp-org:device:MediaRenderer:1
OPT: "http://schemas.upnp.org/upnp/1/0/"; ns=01

NOTIFY * HTTP/1.1
Host: 239.255.255.250:1900
Cache-Control: max-age=1800
Location: http://192.168.0.4:53208/upnp/1
NT: urn:schemas-upnp-org:device:MediaRenderer:1
NTS: ssdp:alive
Server: CESTB/6.1 UPnP/1.0 DMP/5.0
USN: uuid:-----------------------------::urn:schemas-upnp-org:device:MediaRenderer:1
OPT: "http://schemas.upnp.org/upnp/1/0/"; ns=01

NOTIFY * HTTP/1.1
Host: 239.255.255.250:1900
Cache-Control: max-age=1800
Location: http://192.168.0.4:53208/upnp/1
NT: urn:schemas-upnp-org:service:ConnectionManager:1
NTS: ssdp:alive
Server: CESTB/6.1 UPnP/1.0 DMP/5.0
USN: uuid:-----------------------------::urn:schemas-upnp-org:service:ConnectionManager:1
OPT: "http://schemas.upnp.org/upnp/1/0/"; ns=01


If you visit the following URL, you will be met with this xml:

http://192.168.0.4:53208/upnp/1  <--- box IP address

Code: [Select]


  <?xml version="1.0" encoding="utf-8" ?>
- <root xmlns="urn:schemas-upnp-org:device-1-0">
- <specVersion>
  <major>1</major>
  <minor>0</minor>
  </specVersion>
- <device>
  <deviceType>urn:schemas-upnp-org:device:MediaRenderer:1</deviceType>
  <dlna:X_DLNADOC xmlns:dlna="urn:schemas-dlna-org:device-1-0">DMR-1.50</dlna:X_DLNADOC>
  <UDN>uuid:-----------------------------</UDN>
  <friendlyName>Mediaroom Device</friendlyName>
  <manufacturer>Mediaroom</manufacturer>
  <manufacturerURL>http://www.microsoft.com/</manufacturerURL>
  <modelName>Mediaroom</modelName>
  <modelNumber>Microsoft Windows CE 5.0.1400</modelNumber>
  <modelURL>http://www.microsoftmediaroom.com/</modelURL>
  <modelDescription>Mediaroom Client</modelDescription>
  <serialNumber>----------</serialNumber>
- <iconList>
- <icon>
  <mimetype>image/png</mimetype>
  <width>48</width>
  <height>48</height>
  <depth>24</depth>
  <url>/upnp/2</url>
  </icon>
  </iconList>
- <serviceList>
- <service>
  <serviceType>urn:schemas-upnp-org:service:ConnectionManager:1</serviceType>
  <serviceId>urn:upnp-org:serviceId:ConnectionManager</serviceId>
  <SCPDURL>/upnp/4</SCPDURL>
  <eventSubURL>/upnp/4e</eventSubURL>
  <controlURL>/upnp/4c</controlURL>
  </service>
- <service>
  <serviceType>urn:schemas-upnp-org:service:AVTransport:1</serviceType>
  <serviceId>urn:upnp-org:serviceId:AVTransport</serviceId>
  <SCPDURL>/upnp/5</SCPDURL>
  <eventSubURL>/upnp/5e</eventSubURL>
  <controlURL>/upnp/5c</controlURL>
  </service>
- <service>
  <serviceType>urn:schemas-upnp-org:service:RenderingControl:1</serviceType>
  <serviceId>urn:upnp-org:serviceId:RenderingControl</serviceId>
  <SCPDURL>/upnp/3</SCPDURL>
  <eventSubURL>/upnp/3e</eventSubURL>
  <controlURL>/upnp/3c</controlURL>
  </service>
  </serviceList>
  </device>
  </root>


It states that it wants to connect to Windows Media Player 11, but I managed to get it to connect to PS3 Media Server! Then you can browse it for media. The silver BT Vision box had secret DLNA capability the whole time. And there was no need to install mod-chips on the box, just booting into the secret menu was all that was required!

2

Others / BT servers switching off 22 July 2014. End of BT Vision?

16. Jul 2014, 21:15

BT sent a letter in the post saying they are axing the BT Vision service on 22 July 2014. More info on it here: http://www.a516digital.com/2014/04/bt-vision-to-close-this-summer.html

If they really do turn the servers off, then the silver BT Vision box could become unbootable and unusable even as a Freeview PVR. It is a sad day. The silver BT Vison box was a good solid PVR, shame to see BT kill a perfectly good piece of kit (and appallingly wasteful and damaging for the environment). It never missed a recording or developed problems with its hard drive in 5 solid years of service.

Other Freeview PVRs are apparently very unreliable and prone to going wrong (most of them Linux based). So I'm really going to miss the silver box if BT actually do kill it off.

The question is, could there be any way to get a computer to impersonate the BT servers so the silver box can continue to live a happy life as a Freeview PVR?

The silver boxes communications with the BT servers are encrypted, so can't be easily replicated.  Has anyone had any success in decrypting it or peeking inside the boxes code to see what kind of responses a fake BT server should give?

3

Software / BT Vision Box Hidden Menus

10. Sep 2013, 17:55

I switched on my Philips DIT9719 BT Vision box the other day and the menu had changed - to a secret hidden menu. The Recordings menu had dissappeared, but new menu items had come up such as:

- Demo
- Extras
- XHTML Test
- http://172.29.50.50/ajax.html
- http://172.29.50.50/mosaic.html
- CSS Acid Test
- Ajax test
- Mr Youtube
- Static Weather
- Photos and Music
- Videos
- Static Media
- Launch Application
- MediaStream PiP test
- Mediaroom services
- Client AV Storefront
- WMS Seamonkey test
- Personal media settings
- Enable playback from home network

There was an option for browsing photos and videos on the local network, it said a PC with Windows Media Player 11 was required.

There was no TV Channels, just a black screen. Pressing the "i" info button on the remote control caused the box to reboot and it rebooted back to the normal menu. I can't get back into this hidden menu.

I don't know why this hidden menu came up. Was it just a bug in the BT Vision box, or is there a secret key combination you can type into the remote control to bring it up? Or do you have to press certain buttons on the box whilst turning it on? I have read in another thread of secret key codes that bring up diagnostic text, but what is the way to bring back this secret menu? I need to get back into this secret menu!!! Has anyone else accessed this secret menu?

The Ajax test is interesting, Windows CE v5 apparently has a JPG/Gif exploit for it. If you could use the Ajax test to load a specially crafted JPG/Gif, then you could load custom code onto the BT Vision box without the need for any soldering!

Screenshots of the hidden menus are attatched