1. This site uses cookies. By continuing to use this site, you are agreeing to our use of cookies. Learn More.

Executing flash code on series 4 units

Discussion in 'TiVo Underground' started by moyekj, Apr 16, 2012.

  1. moyekj

    moyekj Well-Known Member

    11,134
    27
    Jan 23, 2006
    Mission...
    Over this past weekend I discovered a way to execute flash (swf) via the Series 4 RPC protocol. i.e. Execute an arbitrary flash (swf) url such as:
    Code:
    http://www.bbc.co.uk/science/humanbody/sleep/sheep/reaction_version5.swf
    Note that with the above flash example I was able to get Premiere to respond to left/right/select remote presses so looks at least some rudimentary remote control input seems to be possible.

    NOTE: This works whether using SDUI or HDUI.

    I know very little about flash programming but exploring a little more I made a simple "Hello World!" ActionScript 2 script and compiled to swf with the free mtasc compiler and served up the resulting swf to my Premiere via a simple Python web server and verified that it ran.

    Don't know if a fully custom flash application responding to various remote control presses is possible and if for example serving up video through flash would be possible as well. Above simple "Hello World!" script is as far as I got. I tried to do a little with event listeners to see if I could figure out how to capture remote control presses but didn't get anywhere with that.

    At any rate I thought this was at least mildly interesting and figured I would post here to see if anyone perhaps with more flash experience has an interest in exploring this further. I can post some code for someone to get going on this and replicate what I have done so far if there is any interest.
     
  2. Soapm

    Soapm Active Member

    1,564
    0
    May 9, 2007
    So close,...
    Very interesting but it's to close to a way to brick your S4 for me to give it a try. And I'm the adventurous type...
     
  3. wmcbrine

    wmcbrine Ziphead

    10,364
    22
    Aug 2, 2003
    DUDE.

    Yes this is mildly interesting. :) Moar plz.
     
  4. moyekj

    moyekj Well-Known Member

    11,134
    27
    Jan 23, 2006
    Mission...
    OK, here's a zip package which I think has all the stuff to get started along with a README.txt summarizing each file:
    http://kmttg.googlecode.com/files/TiVoFlash.zip

    Basically to get started edit run.bat (Windows) or run.sh (Linux) to set your Series 4 IP and your 10 digit MAK and then just run the script.

    Once you have the sheep swf working if you like you can make your own and use webserver to serve it up. Start with provided sample.swf file as starting point. You can test webserver with your browser first.

    NOTE: If you give a bad URL you could hangup your Premiere GUI for a while (I've done it a couple of times). Use at your own risk, etc.
    It's late so I may have messed up making the package. Let me know if something is missing or not clear.

    (NOTE: I would have preferred to keep everything Python for simplicity but I'm not sure how to do socket PKCS12 authentication with Python and since kmttg.jar has pretty much everything needed I was lazy and just used it. Technically current software doesn't need PKCS12 authentication but it will be needed in "Spring" software release so I'm already ready for that.)
     
  5. wmcbrine

    wmcbrine Ziphead

    10,364
    22
    Aug 2, 2003
    Um... source code for TiVoFlash.jar?
     
  6. moyekj

    moyekj Well-Known Member

    11,134
    27
    Jan 23, 2006
    Mission...
    I don't have it with me right now, but the bottom line to execute flash is simply an RPC request with following JSON (substitute URL accordingly):
    Code:
    {"type":"uiNavigate","uiDestinationType":"flash","uri":"x-tivo:flash:URL","bodyId":"-"}
    
    bodyId may have to be TSN but probably "-" as above works.

    P.S. I found it by going through return values after querying uiDestinationType of type "flash" with following RPC request:
    Code:
    {"type":"uiDestinationInstanceSearch","uiDestinationType":"flash","levelOfDetail":"high","noLimit":"true"}
    
    There's some more interesting stuff there if you go through the returned list.
     
  7. wmcbrine

    wmcbrine Ziphead

    10,364
    22
    Aug 2, 2003
    I couldn't get your package to run on my Mac; it said 'Exception in thread "main" java.lang.NoClassDefFoundError: Main'. Anyway, I took the info from above and put it into a Python script from the "Discovering the iPad interface" thread. I'll worry about PKCS12 authentication later.

    The sheep game doesn't play too well, but here's a game that fully works:

    Code:
    http://91.121.199.16/1980-games/flash4/jeux-reflexion/jeux-flash/reversi.swf
    Yeah, of course, I would pick that. :) Although the first thing I tried (after the sheep) was:

    Code:
    http://www.homestarrunner.com/trogdor.swf
    I can't get past the intro screen, but it's fun to see even that on a TiVo.

    I suspect these can also be launched somehow from HME, or perhaps directly from the "Showcases" menu. We still have this one cryptic comment from a guy who never came back.

    This is what I'm using for now:
     

    Attached Files:

  8. moyekj

    moyekj Well-Known Member

    11,134
    27
    Jan 23, 2006
    Mission...
    Still hoping someone that is familiar with Flash can run with this.
    ActionScript 2 kind of blows as a language from the little I played with it and apparently is being phased out. ActionScript 3 seems better but a similar "Hello World" swf I created using as3 via FlashDevelop didn't run on TiVo (browser worked fine). There seems to be many kinds of Flash so just figuring out what the TiVo player will or will not play may be a challenge. I guess TiVo is using "Adobe Air" whatever that is (and apparently is not going to be further developed by Adobe).

    First step would be to figure out how to respond to remote control presses with eventual goal of trying out video. Really hope that annoying 1.1GB buffer limit is not in play here since that's the real killer of the non-flash HME method (which is copy rather than stream). There must be a way to stream via Flash rather than copy. I figure the upcoming revamped Netflix & YouTube HME apps being talked about in the TCF forums are most likely Flash based and use streaming.
     
  9. Iluvatar

    Iluvatar New Member

    377
    0
    Jul 22, 2006
    I wouldn't think that would be a problem with FFmpeg and rtmp streaming. Hulu+ is serving up flv files through rtmp (well encrypted rtmp). Would be easy to mux streams into a flv to serve up. The rest of the framework is the real work :p

    edit: I meant to say FFmpeg along with a FMS server. I believe there are a few opensource Python modules that could be used for the purpose.
     
  10. Soapm

    Soapm Active Member

    1,564
    0
    May 9, 2007
    So close,...
    When you said flash I thought of flashing the prom or one of the chips on the board so I guess I wouldn't be much help... :)
     
  11. moyekj

    moyekj Well-Known Member

    11,134
    27
    Jan 23, 2006
    Mission...
    That certainly sounds promising.
    So far I've been unable to get any compiled AS3 code to run. Only compiled AS2 code seems to run for me so far. I actually have keyboard event listener working in AS3 code that works when running in a browser.
     
  12. Iluvatar

    Iluvatar New Member

    377
    0
    Jul 22, 2006
    I don't profess to know anything about Flash but at one point the Copyright & Trademarks screen under System Info on the TiVo listed AS2 modules being used for its interface. I've heard they are migrating to Air and Flash Lite but I'm uncertain how that relates to the full Flash API versioning as far as feature and scripting compatibility would go.

    edit...
     
  13. cyphers72

    cyphers72 New Member

    26
    0
    Jul 7, 2002
    I get no response at all from uiDestinationInstanceSearch. Every other command seems to work. Python script works. Auth and keys work. Have tried setting body_id to the TSN in both the header and body with no luck. The box doesn't reply at all. No error, nothing. Authentication and other keys work like Pause, etc.

    I'm calling it this way from the script:

    req = RpcRequest('uiDestinationInstanceSearch', uiDestinationType='flash', levelOfDetail='high', noLimit='true', bodyId='tsn:XXXXXXXXXX')

    The log output looks sane. I feel like something is missing from the command. Have tried against both an Elite and a normal Premier. Anyone have maybe a raw log output from a working uiDestinationInstanceSearch that is verified against a real box?
     
  14. moyekj

    moyekj Well-Known Member

    11,134
    27
    Jan 23, 2006
    Mission...
    If using the python script you need to add printing of return values. i.e. After:
    result = self.Read()
    Add:
    print result
     
  15. moyekj

    moyekj Well-Known Member

    11,134
    27
    Jan 23, 2006
    Mission...
    Progress.

    AS2 code to get button press keycodes:
    keyboard.as
    Code:
    // Compile: mtasc -swf keyboard.swf -main -header 800:600:20 keyboard.as
    
    class Sample {
       static var app:Sample;
       
       function Sample() {
          // entry point
          // Define text formatting
          var emphatic:TextFormat = new TextFormat();
          emphatic.bold = true;
          emphatic.size = 20;
               
          // creates a 'tf' TextField size 800x600 at pos 0,0
          _root.createTextField("tf",0,0,0,800,600);
          // write some text into it
          _root.tf.text = "HELLO WORLD !";
          _root.tf.setTextFormat(emphatic);
         
          Key.addListener(_root);
          _root.onKeyDown = function() {
              _root.tf.text = "Key Pressed: keyCode=" + Key.getCode();
              _root.tf.setTextFormat(emphatic);
          };
        }
    
       // entry point
       static function main(mc) {
          app = new Sample();
       }   
    }
    
    keycodes derived from above:
    Code:
    select      13
    left        37
    up          38
    right       39
    down        40
    0           48
    1           49
    2           50
    3           51
    4           52
    5           53
    6           54
    7           55
    8           56
    9           57
    vol up      16777217
    vol down    16777218
    mute        16777219
    chan up     16777220
    chan down   16777221
    record      16777222
    play        16777223
    pause       16777224
    ff          16777226
    rew         16777227
    skip forw   16777228
    skip back   16777229
    enter       16777233
    
    thumbs up   33554439
    thumbs down 33554440
    info        33554444
    slow        33554462
    aspect      33554485
    
    APPLICATION EXIT KEYS
    Live TV
    Guide
    TiVo
    Clear
    
    Sample AS2 code to embed a YouTube video:
    movie.as
    Code:
    // Compile: mtasc -swf movie.swf -main -header 800:600:20 movie.as
    class Sample {
       static var app:Sample;   
       function Sample() {
          _root.createEmptyMovieClip("video_mc", _root.getNextHighestDepth());
          _root.video_mc.loadMovie("http://www.youtube.com/v/b694exl_oZo");
       }
    
       // entry point
       static function main(mc) {
          app = new Sample();
       }   
    }
    
     
  16. cyphers72

    cyphers72 New Member

    26
    0
    Jul 7, 2002
    Got it working, thanks.

    Looks like the tunerStateEventRegister call has changed since the initial research last year. It now complains "Must specify monitoring." Anyone know what to pass for that? The error is mentioned in the old thread, but none of the samples use it so I assume this was a software change. I've tried passing "true" and "foreground" with a "monitoring" parameter but no dice.
     
  17. moyekj

    moyekj Well-Known Member

    11,134
    27
    Jan 23, 2006
    Mission...
    As defined in python script the 'monitor' parameter is type Boolean not string so should be either True or False (which in turn will set ResponseCount in header to either 'multiple' or 'single'). So in this case you should set it to True. I use this one in kmttg so I know it works.
     
  18. moyekj

    moyekj Well-Known Member

    11,134
    27
    Jan 23, 2006
    Mission...
    So I take it nobody has pursued this further? My challenge to someone willing to look into it further is to get full screen FLV video via ActionScript 2. Bonus points for some basic trick play functionality included (keycodes for most TiVo remote buttons are posted above). Double bonus points for using streaming instead of loading a whole movie. One would think that would be trivial since after all Flash was designed with video in mind but I found AS2 language extremely poor and unintuitive and spent half a day searching for a way to do it and found nothing. Little wonder AS2 was abandoned in favor of AS3 but of course leave it to TiVo to apparently only support the older/crappier AS2. I knew nothing about Flash stumbling into this functionality and now I'm starting to see why Steve Jobs never endorsed it...
     
  19. moyekj

    moyekj Well-Known Member

    11,134
    27
    Jan 23, 2006
    Mission...
    FYI, I did find an example of getting flv video playback via AS2 using FlashDevelop IDE from here:
    http://www.flashdevelop.org/community/viewtopic.php?p=1583

    Specifically the FlashDevelop project can be downloaded here:
    http://flashdevelop.org/downloads/documents/VideoSample-1.0.0.zip

    (Important part to note is the video object swf is compiled from xml file using "swfmill" as you apparently can't define a video object directly in AS2 for some stupid reason).

    Works fine in Adobe Flash player and web browser, but on TiVo just the text shows up, not the video portion...
     
  20. cyphers72

    cyphers72 New Member

    26
    0
    Jul 7, 2002
    I think the mdns trace code will need to be revived. With data that is somewhat old now, the last comments were that the mdns SSL MITM trace code from arantius didn't seem to work with 1.5 yet. As it's now 1.9.1, I think some things have changed. I noticed various windowing-style behaviors that are unexplained. The Flash thing you mention sounds like one of those where you may need to tell the UI navigator where to be first.

    In particular, I can't figure out how to change channels -- other than sending 4 separate key events of course. This can obviously be performed via the API and the official app does it, but the traces seem to have captured only how to navigate to a recording. Given the ability to get fresh data from the app, I think virtually any question could be resolved.
     

Share This Page