In my quest to create an Android app I got into the wireless chip on the Horizon box (from UPC, or worldwide better known as Liberty). Something sophisticated such as the UPNP exploit (rapid7 blog) is absolutely not necessary. The Celeno chip is easily accessible, but how I cannot tell:
$> cat /proc/version
Linux version 2.6.21 (test@ubuntu) (gcc version 3.4.2) #39 Sun Feb 3 07:15:23 PST 2013
By the way, the main processor is a different one, an Intel Atom CE Media Processor.
A picture of the mediabox, though this is definitely not necessary for the hack. :-)
You can see more pictures in (horizon/pictures), but you have to be patient (it takes a while to load) because I kept them hi-res, so you hopefully can read the text on the chips (forgive my crappy photographer skills).
The serial port, labelled UART, on the mother board spits out data in incredible fast rate. The thing I use (the Saleae) cannot keep up on 10 MHz. I am only used to slow robots apparently, because that's not something I've seen before on a UART.
If you know what this is, help me please.
There is a Samsung console port. Apparently they are used more often on Samsung devices. Please, can anyone post me information on it, if it is operational?
The open-source code that is used for the SMT-G4700 (but which is not developed by the consortium partners) can be found on the Open Source Release Center.
- Wi-Fi is done by the (Israelian) company Celeno. Information can be found in the folder Celeno.
- MoCA (the coax implementation) is done by (American) Entropic.
- Conditional access is implemented by Nagravision subsidiary of the (Swiss) Kudelski Group.
- The middleware and user interface is done by (Israelian) NDS. The NDS MediaHighway middleware is a competitor to OpenTV (the sister company of Nagravision). The NDS interface is called NDS Snowflake. It is sometimes said to be Flash-based, but might very well be HTML5. Remote management is done through Jungo Panorama. NDS has been acquired by Cisco. The NDS EPG is incredibly like XBMC. And yes, looking at the Samsung release center, there is a "diff_ssl" file with a diff between "xbmc-9.11_original" and "ssl_rachid/XBMC_WP1385".
- Streaming the stuff to your devices and some additional media services is done by KIT digital based in New York.
- They worked together with thePlatform based in Seattle. thePlatform MPX has an "open" API for a select set of developers I suppose.
- The widgets framework are written by Metrological (Rotterdam, The Netherlands) and is called Yuixx. It has widgets from for example hardware.info and 5minuten.tv. Yuixx seems down.
- The horizon.tv part is written by Empathy Lab (Pennsylvania), builds on Adobe CQ5, and has WideVine for DRM. It is "integrated" with thePlatform MXP and KIT digital SOA, but it is not clear to me who did what.
- Some of the iOS applications are implemented by Intellicore Services (France) and their old website. Frédéric Blanc led a team of 12 people to implement the "second screen" or the "companion device" (see iTunes).
[1] broadbandtrends.com [2] emerce.nl [3] intellicore.net
There are some online sources:
- openmha has directories referring to Zon (NDS build stuff for them fore UPC), references to snowflake, stuff on Android development, and many different drafts for app stores.
- NDS Service Delivery Platform for interfacing to companion devices to 3rd party developers
The last platform is quite promising, but this possibility has not communicated by UPC at all. It is probably not meant to be really used by thousands of developers. Somehow "protecting" the brand. This is why these set-top boxes will loose in the end to a complete TV over IP experience. NDSs vision is to have an "InfiniteTV Exchange", a business-to-business content marketplace, not realizing that content is provided by people for people and TV should just be a medium and not try to prevent others from adding their content too. But who knows!? Things change!
- EPG: Electronic Program Guide, also IPG: Interactive Program Guide
- OTT: Over-The-Top content
- DRM: Digital Rights Management
This is not something that exposes your box to others. It is just between you and your Horizon box. If I would have the slightest idea that it would hurt people, I would not publish this. Moreover, this is allowed in Holland (see the iusmentis.com blog) depending on the reason.
There are two reasons for me to do this: a.) to understand the set top box, b.) to be able to create my own smartphone software to interface with it. Both are valid reasons to inspect the box. Also, note that I had to pay 50 euros for my box. I think it's quite a lot for just taking a look inside a box. :-D Also, note that I did not put source code online. I only put binaries (which you will need to reverse engineer yourself if you want to, and shell scripts online). If your most valuable business logic resides in shell scripts, there is something wrong with your company, so I cannot imagine that this would upset anyone. :-)
Also, maybe different from others, I do not mind DRM, the right to protect content so people need to pay for copying it for example. Personally I do like Spotify for example which does not give me any ownership rights. I will not publish anything that makes it possible to reverse engineer the encryption of the horizon box media content. Broadcast companies should be able to get money for their services, although I think they can earn more by enabling the content of other's. Apple gets 30% for every app!
Again, the purpose of all this is to have people help me creating own software for the box, being able it to control it from an Android smartphone or a Raspberry PI, or other cool stuff. This falls in the same ballpark as being able to control the Emotiv Epoc, the Kinect, the Brookstone Rover, rooting your iPhone, or Android phone. Applications:
- Have your own applications navigating through the program guide
- Integrate with home automation software, the volume of the television goes up when your husband starts vaccuum cleaning
- Use the Horizon box for Bitcoin mining
- Make browsing on your TV a "normal" experience just as on your laptop or tablet
I definitely can use some help in getting to the rest of the box. Feel free to email me (see my github page for my email address).