1. This site uses cookies. By continuing to use this site, you are agreeing to our use of cookies. Learn More.

Discovering the iPad interface

Discussion in 'TiVo Underground' started by wmcbrine, Jan 18, 2011.

  1. Feb 20, 2011 #21 of 366
    moyekj

    moyekj Well-Known Member

    11,143
    32
    Jan 23, 2006
    Mission...
    Note that the .ipa file you can just re-name to .zip and then you can unzip it as a normal zip file. This extracts to Payload/Quicksilver-TiVo.app with a whole lot of files under that, including many png image files. Interestingly there is a "tivo.cer" SSL certificate file there which can be converted to PEM format (using openssl) and used with wireshark to decrypt SSL communications.
    I do have a hub and wireshark setup, however I'm missing the key piece to the puzzle - the iPad.
    I used "grep" and various other utilities to look through the .ipa set of files but didn't find any interesting http/https/telnet looking entries.
     
  2. Feb 20, 2011 #22 of 366
    innocentfreak

    innocentfreak Active Member

    8,950
    3
    Aug 25, 2001
    Florida
    I know Orangeboy asked TiVodesign previously about a public API prior to the iPad app, but she said he would most likely have to sign some type of agreement.

    I do agree though it should be public.
     
  3. Feb 26, 2011 #23 of 366
    jbuehl

    jbuehl New Member

    19
    0
    Nov 23, 2004
    Los Angeles, CA
    I captured some iPad-Tivo traffic to try and figure out an issue that I'm having with having to constantly reboot the Tivo to get the iPad app to work. I used an old ethernet hub and captured the traffic using Wireshark.

    I can see a socket being opened by the iPad to port 1393 on the Tivo. The messages are binary, but they don't appear to be encrypted. It's definitely not SSL.
     
  4. Feb 27, 2011 #24 of 366
    moyekj

    moyekj Well-Known Member

    11,143
    32
    Jan 23, 2006
    Mission...
    Post a couple more times so you have enough to attach a zip file with the wireshark pcap file so we can take a look?
     
  5. Feb 27, 2011 #25 of 366
    jbuehl

    jbuehl New Member

    19
    0
    Nov 23, 2004
    Los Angeles, CA
    OK, will do.
     
  6. Feb 27, 2011 #26 of 366
    jbuehl

    jbuehl New Member

    19
    0
    Nov 23, 2004
    Los Angeles, CA
    Here is a hex dump of the conversation between the iPad and the Tivo. This is the case where it is failing to work for me.


    iPad:
    00000000 16 03 01 00 45 01 00 00 41 03 01 4d 69 28 bf c6 ....E... A..Mi(..
    00000010 12 38 2e 2a 77 11 96 d7 35 e8 9a 00 70 85 0e b1 .8.*w... 5...p...
    00000020 81 80 9f 29 8b dc ed 1d 4b d3 e3 00 00 1a 00 2f ...).... K....../
    00000030 00 05 00 04 00 35 00 0a 00 09 00 03 00 08 00 33 .....5.. .......3
    00000040 00 39 00 16 00 15 00 14 01 00 .9...... ..

    Tivo:
    00000000 16 03 01 00 4a 02 00 00 46 03 01 4d 69 27 f6 bb ....J... F..Mi'..
    00000010 05 e5 14 dd a5 56 3d 65 fb 3d f1 21 12 a3 87 9d .....V=e .=.!....
    00000020 8f 9d 1c 6a 6a 6f e3 88 96 1b 54 20 a1 37 4c c9 ...jjo.. ..T .7L.
    00000030 78 8f 21 85 cc 18 75 30 15 5f 08 03 1b 51 d2 91 x.!...u0 ._...Q..
    00000040 54 13 4b b3 8b 93 39 6f 48 bd ba 54 00 2f 00 16 T.K...9o H..T./..
    00000050 03 01 02 67 0b 00 02 63 00 02 60 00 02 5d 30 82 ...g...c ..`..]0.
    00000060 02 59 30 82 01 c2 02 09 00 e9 89 1d ff 4b 58 c7 .Y0..... .....KX.
    00000070 20 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 0...*.H ........
    00000080 30 71 31 1b 30 19 06 03 55 04 03 13 12 37 34 36 0q1.0... U....746
    00000090 2d 30 30 30 31 2d 39 30 32 34 2d 32 45 43 31 31 -0001-90 24-2EC11
    000000A0 12 30 10 06 03 55 04 0a 13 09 54 69 56 6f 20 49 .0...U.. ..TiVo I
    000000B0 6e 63 2e 31 0b 30 09 06 03 55 04 0b 13 02 49 54 nc.1.0.. .U....IT
    000000C0 31 0f 30 0d 06 03 55 04 07 13 06 41 6c 76 69 73 1.0...U. ...Alvis
    000000D0 6f 31 13 30 11 06 03 55 04 08 13 0a 43 61 6c 69 o1.0...U ....Cali
    000000E0 66 6f 72 6e 69 61 31 0b 30 09 06 03 55 04 06 13 fornia1. 0...U...
    000000F0 02 55 53 30 1e 17 0d 31 30 30 31 32 36 31 39 32 .US0...1 00126192
    00000100 39 34 39 5a 17 0d 32 30 30 31 32 34 31 39 32 39 949Z..20 01241929
    00000110 34 39 5a 30 71 31 1b 30 19 06 03 55 04 03 13 12 49Z0q1.0 ...U....
    00000120 37 34 36 2d 30 30 30 31 2d 39 30 32 34 2d 32 45 746-0001 -9024-2E
    00000130 43 31 31 12 30 10 06 03 55 04 0a 13 09 54 69 56 C11.0... U....TiV
    00000140 6f 20 49 6e 63 2e 31 0b 30 09 06 03 55 04 0b 13 o Inc.1. 0...U...
    00000150 02 49 54 31 0f 30 0d 06 03 55 04 07 13 06 41 6c .IT1.0.. .U....Al
    00000160 76 69 73 6f 31 13 30 11 06 03 55 04 08 13 0a 43 viso1.0. ..U....C
    00000170 61 6c 69 66 6f 72 6e 69 61 31 0b 30 09 06 03 55 aliforni a1.0...U
    00000180 04 06 13 02 55 53 30 81 9f 30 0d 06 09 2a 86 48 ....US0. .0...*.H
    00000190 86 f7 0d 01 01 01 05 00 03 81 8d 00 30 81 89 02 ........ ....0...
    000001A0 81 81 00 a1 7f 64 d3 32 d5 15 c8 97 98 4a fe 75 .....d.2 .....J.u
    000001B0 e2 8f 13 3e 0a d4 0b f6 c4 77 c0 db df da 96 e1 ...>.... .w......
    000001C0 ad 72 4b 1f a8 e6 47 13 e4 0f a5 90 0b 00 fb 0e .rK...G. ........
    000001D0 0e cc f5 ca 1c cc 51 47 8e aa fb 79 96 69 d5 3b ......QG ...y.i.;
    000001E0 46 31 08 a9 57 96 6d 3d 27 1f 77 2e ac 7c e1 3b F1..W.m= '.w..|.;
    000001F0 76 94 ff e1 2f 20 84 fa d2 6e 79 4e e1 49 af d6 v.../ .. .nyN.I..
    00000200 e4 b7 e2 e3 77 8f ee da 6d 6c 54 5d 20 9c 39 5e ....w... mlT] .9^
    00000210 7f 98 fd a5 4a 43 17 37 2a 9a 77 f2 53 df 1e 8b ....JC.7 *.w.S...
    00000220 fa ec c3 02 03 01 00 01 30 0d 06 09 2a 86 48 86 ........ 0...*.H.
    00000230 f7 0d 01 01 05 05 00 03 81 81 00 85 fd 97 27 b4 ........ ......'.
    00000240 25 9d 18 d1 88 d5 a7 e5 f8 41 f9 e6 40 b5 90 6d %....... .A..@..m
    00000250 cf d7 e0 66 e0 12 44 9d 96 47 47 76 2c e7 99 66 ...f..D. .GGv,..f
    00000260 26 8b cb e8 bb b4 15 a4 05 c6 aa 55 72 ea 67 de &....... ...Ur.g.
    00000270 b3 e1 b0 49 17 92 0d af 35 0e 41 54 9c 64 45 21 ...I.... 5.AT.dE!
    00000280 2e ff 7d ac 44 03 74 b7 80 40 51 5e 80 17 54 53 ..}.D.t. .@Q^..TS
    00000290 83 0d ad d5 54 68 f3 8c 56 f3 b7 43 08 a5 73 97 ....Th.. V..C..s.
    000002A0 8a e2 6c 43 e7 93 c0 ed 39 46 49 37 2f fe 4f 52 ..lC.... 9FI7/.OR
    000002B0 20 b8 2f c6 c7 64 39 16 60 8e cb 16 03 01 00 04 ./..d9. `.......
    000002C0 0e 00 00 00 ....

    iPad:
    0000004A 16 03 01 00 86 10 00 00 82 00 80 4f 41 a7 51 7c ........ ...OA.Q|
    0000005A de 12 85 80 e5 c5 27 9e ae e5 c9 a7 28 5a 11 4d ......'. ....(Z.M
    0000006A 6b ac fa 7d 71 2d 56 20 01 57 28 fd 54 38 8c 75 k..}q-V .W(.T8.u
    0000007A 07 4b 32 6b 8f 1e 3d 16 12 ee 5c ac 7a 27 91 2c .K2k..=. ..\.z'.,
    0000008A ee cb ec e5 fc eb 67 74 bf 51 12 dc b6 36 8a b1 ......gt .Q...6..
    0000009A 92 84 9f b3 df 19 75 f5 ac e6 e5 54 15 9d da 5b ......u. ...T...[
    000000AA 66 35 bf 5c ba 03 89 61 f4 b1 82 6f 86 ec 8d 61 f5.\...a ...o...a
    000000BA 3b bf 7b f4 a0 5f d5 ee 1d e8 8b ad 46 2d 42 66 ;.{.._.. ....F-Bf
    000000CA 94 8f 25 fe ef a3 67 6d 73 d7 af ..%...gm s..
    000000D5 14 03 01 00 01 01 16 03 01 00 30 ae 4d 62 0f 03 ........ ..0.Mb..
    000000E5 11 35 8f 14 cf 24 3e b7 f2 08 34 d6 26 51 68 5a .5...$>. ..4.&QhZ
    000000F5 1e 31 24 a2 21 05 2d e5 92 f6 3f 9a e5 b1 ae 30 .1$.!.-. ..?....0
    00000105 f6 4f 1f cc df 9a e7 30 b6 6e c8 .O.....0 .n.

    Tivo:
    000002C4 14 03 01 00 01 01 16 03 01 00 30 9f 8b 34 49 28 ........ ..0..4I(
    000002D4 94 06 dc ca ee 6b b4 37 13 52 09 de b5 77 95 1d .....k.7 .R...w..
    000002E4 b5 3c 9e 10 3a 07 d7 60 fc e2 55 18 05 db fd 4c .<..:..` ..U....L
    000002F4 37 a0 d0 20 8e 5c ae e0 34 4c bb 7.. .\.. 4L.

    iPad:
    00000110 17 03 01 00 d0 97 a7 c8 54 b8 a5 54 e5 33 e5 4f ........ T..T.3.O
    00000120 97 14 50 64 5e d6 f1 2b fc 0b 16 d5 cf d1 b8 67 ..Pd^..+ .......g

    iPad:
    00000130 b4 29 a9 ce fb c8 9c e6 1b e4 cd 2e 4b b2 f4 9a .)...... ....K...
    00000140 05 03 8a 4e 9d 2b cf d5 b0 4e 83 d4 e5 2e 96 d0 ...N.+.. .N......
    00000150 e2 61 75 ab e3 9d fc e6 10 fc 0b 1c 63 ac 05 45 .au..... ....c..E
    00000160 cf 37 ad ac f1 88 b2 ec aa e6 d8 0c 09 df 6b cc .7...... ......k.
    00000170 6d 78 df 2e 1a 05 73 d8 1d a8 0e bf ad d0 b6 0f mx....s. ........
    00000180 c8 c8 ae 10 69 80 a5 ad e9 d7 7a 2c cc 4f 8b 9e ....i... ..z,.O..
    00000190 2d 94 d0 db 70 a6 08 a4 08 f2 e0 ff e2 f7 f7 ad -...p... ........
    000001A0 5c 27 92 b7 b4 ee 3e 78 23 75 a3 a2 46 fb d2 7a \'....>x #u..F..z
    000001B0 6e ec e4 76 c1 ed b5 b0 d2 f6 50 06 f9 25 b6 8c n..v.... ..P..%..
    000001C0 27 68 4e 82 ef 89 68 b0 00 68 7d b3 54 cf 04 d8 'hN...h. .h}.T...
    000001D0 f5 9c 33 c8 cb ac 0c f9 40 b8 30 b0 f7 c8 d4 fa ..3..... @.0.....
    000001E0 54 a5 17 6e 27 T..n'

    Tivo:
    000002FF 17 03 01 00 20 07 ae 28 d4 4f 73 fe 06 5f d3 2b .... ..( .Os.._.+
    0000030F 57 d3 90 04 55 c5 98 c3 03 60 85 84 4d 72 38 80 W...U... .`..Mr8.
    0000031F f4 f7 2f d7 06 17 03 01 00 d0 39 65 27 66 f2 86 ../..... ..9e'f..
    0000032F c1 54 21 b5 74 48 01 e3 c1 cc de 12 45 1f 95 c4 .T!.tH.. ....E...
    0000033F e3 02 47 95 f1 4d 86 b5 c6 86 bf 93 c5 c1 3e 5d ..G..M.. ......>]
    0000034F 15 70 75 e6 75 d2 3f 62 63 6b e4 31 52 ca ce 95 .pu.u.?b ck.1R...
    0000035F 4a de ff c1 86 8d c1 c4 59 3c 6e 03 1c 3d f7 0d J....... Y<n..=..
    0000036F 84 bb 47 c3 7f 56 e9 5c ec 36 6b 89 7e 37 28 a6 ..G..V.\ .6k.~7(.
    0000037F 45 bb b1 fe ef ab 8a b7 96 b0 72 f6 82 0c 1f 1c E....... ..r.....
    0000038F f8 c4 7b 19 22 c6 0e 51 f8 eb 09 6c 1b fd 7a 0f ..{."..Q ...l..z.
    0000039F 85 76 d3 e8 fe 2d 6e 8a b0 27 45 4f c2 0c 72 9b .v...-n. .'EO..r.
    000003AF 82 6e 88 50 d4 82 62 74 c9 8a 96 ee 4c 75 46 0a .n.P..bt ....LuF.
    000003BF 6a 40 c7 8f 88 b8 db ad 02 a4 e2 0c d4 ad 5e 9c j@...... ......^.
    000003CF 85 c3 7c 4e f0 00 d2 6e f1 0e 85 7a 6c 01 b5 5d ..|N...n ...zl..]
    000003DF f9 de f9 7c 31 1e f4 30 b0 bb 97 16 4c 34 fd ea ...|1..0 ....L4..
    000003EF fb 8e 74 07 27 d3 2d 82 cd 27 ..t.'.-. .'

    iPad:
    000001E5 17 03 01 00 90 7f ca 76 29 1f 13 78 f2 16 28 85 .......v )..x..(.
    000001F5 bc 66 4a 60 47 6b 21 dc bc e0 d3 5f 78 39 2e ca .fJ`Gk!. ..._x9..
    00000205 3a ef 55 bb 1c 64 c0 d5 35 58 da 59 11 1e 46 ec :.U..d.. 5X.Y..F.
    00000215 63 1a c7 1a fa 8c 0d d5 f4 df 57 16 27 88 aa 4a c....... ..W.'..J
    00000225 38 1a ab a5 b6 87 88 e7 e6 f5 c6 15 72 92 20 f0 8....... ....r. .
    00000235 37 76 ff cc 8d c9 dd 06 a1 9b ee 90 ce d2 94 62 7v...... .......b
    00000245 65 05 2e 69 8f c5 3e 8c f5 ac d1 b2 f8 7a ca 3c e..i..>. .....z.<
    00000255 b7 d6 2f e1 bf 6c 32 45 9c 18 38 e1 ab 15 70 5e ../..l2E ..8...p^
    00000265 43 5d df c3 68 ac c4 0a ce dc 07 e6 96 5c 3c 0d C]..h... .....\<.
    00000275 b9 30 14 bd 00 .0...

    Tivo:
    000003F9 17 03 01 00 20 df a1 ea 79 7d 32 1e 9c 37 5e fc .... ... y}2..7^.
    00000409 a2 24 bb 47 07 7b 01 ac 8d 24 4a 2d fc 39 e3 88 .$.G.{.. .$J-.9..
    00000419 28 dd cc 8e 53 17 03 01 00 f0 71 25 88 5a db fa (...S... ..q%.Z..
    00000429 ec b1 40 b6 fb c8 51 e5 07 c4 af 10 9a 79 5c 6c ..@...Q. .....y\l
    00000439 2d 87 67 37 06 e0 e1 fa 31 f7 c1 27 84 c3 51 2c -.g7.... 1..'..Q,
    00000449 21 06 2a f0 ca 44 b1 3f 3c 69 d8 25 df 54 9b 09 !.*..D.? <i.%.T..
    00000459 d5 f3 f1 fe 98 f4 00 1e af 5a 63 18 2c 94 12 a9 ........ .Zc.,...
    00000469 61 de 5c 8c ba a6 52 2b 19 fa 7b 58 7a 0d 14 6f a.\...R+ ..{Xz..o
    00000479 18 18 c1 04 5b 73 3f e0 07 59 21 76 24 a2 38 29 ....[s?. .Y!v$.8)
    00000489 54 99 46 d7 16 72 62 db 99 d0 0d a5 55 8f 51 2f T.F..rb. ....U.Q/
    00000499 8b 1c 79 9e f8 20 23 0e fc ff c2 75 bf c9 b9 1a ..y.. #. ...u....
    000004A9 ff 1f dc 7d 37 a0 12 c7 9e 17 b7 b5 1e 78 35 19 ...}7... .....x5.
    000004B9 10 6d 1d e0 91 12 f2 af 3b b3 c9 9e 13 b7 98 44 .m...... ;......D
    000004C9 bc b9 e1 a2 aa c0 43 57 13 b1 55 e8 6b fb 1d 74 ......CW ..U.k..t
    000004D9 f3 60 d7 a6 7d a3 3e c2 14 e6 01 24 cc be f0 47 .`..}.>. ...$...G
    000004E9 b3 3a 25 9f ea 05 da 96 76 2a 7b a6 bd c0 d7 53 .:%..... v*{....S
    000004F9 3d 87 16 1f 59 6e e4 be 42 27 65 ce 88 0c 3f d9 =...Yn.. B'e...?.
    00000509 d2 fc 83 65 9b 80 8e 4e 0e f2 ...e...N ..

    iPad:
    0000027A 15 03 01 00 20 81 9e b1 7d c7 57 c7 08 ab 69 1a .... ... }.W...i.
    0000028A 7d b8 81 aa e6 48 a7 46 78 09 93 9d 43 5a 4d 32 }....H.F x...CZM2
    0000029A 86 50 74 73 3c .Pts<
    [/SIZE]
     
  7. Feb 27, 2011 #27 of 366
    jbuehl

    jbuehl New Member

    19
    0
    Nov 23, 2004
    Los Angeles, CA
    All the messages seem to start with 0x14030100, 0x15030100, 0x16030100, or 0x17030100. When I google those it comes up with some references to Skype. That doesn't make any sense.
     
  8. Feb 27, 2011 #28 of 366
    jbuehl

    jbuehl New Member

    19
    0
    Nov 23, 2004
    Los Angeles, CA
    Port 1393 is registered with IANA as network log server, whatever that is.

    # iclpv-nls 1393/tcp Network Log Server
    # iclpv-nls 1393/udp Network Log Server
    # iclpv-nlc 1394/tcp Network Log Client
    # iclpv-nlc 1394/udp Network Log Client
     
  9. Feb 27, 2011 #29 of 366
    moyekj

    moyekj Well-Known Member

    11,143
    32
    Jan 23, 2006
    Mission...
    Can you attach a zip file with the actual pcap file? Rather than just the raw data the header and packet information may have more clues.
     
  10. Feb 27, 2011 #30 of 366
    jbuehl

    jbuehl New Member

    19
    0
    Nov 23, 2004
    Los Angeles, CA
    Yeah, I'm still getting up to 10 posts. Only 2 more to go. I haven't seen this particular restriction in a forum before. I guess they were having a problem with people spamming them with huge uploads or something.
     
  11. Feb 27, 2011 #31 of 366
    jbuehl

    jbuehl New Member

    19
    0
    Nov 23, 2004
    Los Angeles, CA
    So how's the weather in Mission Viejo? We had rain and hail here yesterday.
     
  12. Feb 27, 2011 #32 of 366
    jbuehl

    jbuehl New Member

    19
    0
    Nov 23, 2004
    Los Angeles, CA
    OK, one more...
     
  13. Feb 27, 2011 #33 of 366
    jbuehl

    jbuehl New Member

    19
    0
    Nov 23, 2004
    Los Angeles, CA
    Here is a zip with 2 captures. One is where the iPad app failed to work and one where it succeeded. The successful one doesn't contain the entire exchange between the devices.
     

    Attached Files:

  14. Feb 27, 2011 #34 of 366
    moyekj

    moyekj Well-Known Member

    11,143
    32
    Jan 23, 2006
    Mission...
    OK thanks. As you said it looks like Premiere (192.168.1.151) is communicating on port 1393 with the iPad (192.168.1.138) using TCP/IP communication. I don't see any http/https level communication between them and therefore there is no header information to look at or anything else interesting to look at. So doesn't look like network sniffing is going to be too useful...
     
  15. Feb 27, 2011 #35 of 366
    orangeboy

    orangeboy yes, I AM orangeboy!

    4,083
    0
    Apr 19, 2004
    East Moline, IL
    Something to try (and I don't know if it will help any) -

    Set up this filter in Wireshark to display only traffic between the iPad and Premiere, regardless of port:
    Code:
    (ip.src == 192.168.1.151 and ip.dst == 192.168.1.138) or (ip.src == 192.168.1.138 and ip.dst == 192.168.1.151)
    Use the iPad to navigate around the Premiere, as if it were only a remote control, and make note of the action (used TiVo button, Right Arrow, etc). I haven't seen the app to know if what I'm asking is possible.

    When saving the capture, save only the displayed packets.
     
  16. Feb 27, 2011 #36 of 366
    wmcbrine

    wmcbrine Ziphead

    10,367
    22
    Aug 2, 2003
    Man, you give up way too easily.
     
  17. Feb 27, 2011 #37 of 366
    moyekj

    moyekj Well-Known Member

    11,143
    32
    Jan 23, 2006
    Mission...
    Who said anything about giving up? The revelation that port 1393 is being used on TiVo is a good start and made the exercise well worth while. Just don't know if anything else useful can be gleamed from the captured raw data.
     
  18. Feb 27, 2011 #38 of 366
    jbuehl

    jbuehl New Member

    19
    0
    Nov 23, 2004
    Los Angeles, CA
    Good idea, orangeboy. I'll try that in a while.
     
  19. Feb 27, 2011 #39 of 366
    orangeboy

    orangeboy yes, I AM orangeboy!

    4,083
    0
    Apr 19, 2004
    East Moline, IL
    Hopefully with some methodical testing, something may come of it. And with methodical, I mean hit the TiVo button, wait about 10 seconds, hit Live TV, wait 10 seconds, hit Pause, wait 10 seconds, etc... Something that will clearly show that the action performed was actually captured. Getting to the more esoteric functions like "scrubbing" the progress bar can be done later IF the iPad protocol can be figured out.
     
  20. Feb 27, 2011 #40 of 366
    wmcbrine

    wmcbrine Ziphead

    10,367
    22
    Aug 2, 2003
    Let's see... start with the visible ASCII strings in the initial response from the TiVo (which include the TSN, BTW). I can see that each string is preceded by a length byte, and the length byte is preceded by a byte that may indicate the data type -- it's always 0x13 for the ASCII strings, except for the pure numeric sequences that end in "Z"; they're 0x17. In between these may be sections beginning with 0x30 (followed by a single byte) or 0x31 (followed by eight bytes). Not sure I've parsed that right yet, but it's early. The first group of strings etc. is almost repeated after the numeric strings. (Besides the TSN, the other strings in this group are "TiVo Inc.", "IT", "Alviso", "California", and "US". Admittedly that doesn't seem useful, but it did help confirm the string format.)

    Another thing I might look for would be data in HME-like formats (e.g., variable-length integers and packed dicts), which are also used in push requests, so TiVo seems to like them. But the string format doesn't fit that theme.

    Anyway, there are patterns here; you just have to keep at it.
     

Share This Page