IPTV application update
From t-hack.com - Hack X300T / X301T
First step is to download an index file that contains information about the latest application version and the filenames of the application package:
for T-Home it is found here:
http://cgbf01001.iptv.t-online.de/upgrade/upgrade-files/STB%20Sub-CA%20003/PKG.DIR(not used any more)- http://cgbf01003.iptv.t-online.de/upgrade/upgrade-files/003/PKG.DIR
- http://cgbf01003.iptv.t-online.de/upgrade/upgrade-files/002/PKG.DIR
for BT-Vision it is found here:
NAME: Production_Package_1.2.2099.2 BUILD: 00000833 00040000 DEV DEV DATE: 10/18/2007 PARTITION: 02000000 0109 0307 014C9A58 01757796 PART000.DAT 7BB65704 C760BD76 01066D95 4EF0AA8E 1B9C2 1FE48 2 PART001.DAT 7EBFA0BD 101F6104 17AEFD07 2D0445A7 1BD81 1FE48 2 .... PART264.DAT 0745D14D E1D1DC08 70C5A81A 7ED3F9FF 0F22B 177EA 2 #000040B4 4C964F44 48B2E2E8 4E1D5A57 69E9828D
the PARTxxx.DAT files are located in the same directory as the PKG.DIR file. All the PARTxxx.DAT files are downloaded from the server and Zlib-decompressed if the last number in the row is "2".
the decompressed parts are encrypted with a lame XOR and bitshifting algorithm. after decryption, all the parts are concatenated and the result is a large Archive file similar to a Zip file.
this Archive is then extracted onto the harddisk.
A tool to decompress, decrypt, join and extract the PART files can be found here.
here is the java code to decompress and decrypt PART files:
InputStream in = new FileInputStream("data/"+part.getName());
if (part.isZlib())
{
in = new InflaterInputStream(in);
}
int len = -1;
int partLength = 0;
while ( (len=in.read(buffer)) != -1)
{
for (int i = 0; i < len; i++)
{
byte a = (byte) ( (((int)buffer[i]) >> 5) & 0x07);
byte b = (byte) ( (((int)buffer[i]) << 3) & 0xF8);
byte c = (byte) (a | b);
byte d = (byte) (c ^ (partLength++ & 0xff));
buffer[i] = d;
}
out.write(buffer, 0, len);
}
