TiVo Community
TiVo Community
TiVo Community
Go Back   TiVo Community > Underground Playground > TiVo Underground
TiVo Community
Reply
Forum Jump
 
Thread Tools
Old 04-16-2012, 08:53 PM   #1
moyekj
Registered User
 
Join Date: Jan 2006
Location: Mission Viejo, CA
Posts: 9,098
Executing flash code on series 4 units

Over this past weekend I discovered a way to execute flash (swf) via the Series 4 RPC protocol. i.e. Execute an arbitrary flash (swf) url such as:
Code:
http://www.bbc.co.uk/science/humanbody/sleep/sheep/reaction_version5.swf
Note that with the above flash example I was able to get Premiere to respond to left/right/select remote presses so looks at least some rudimentary remote control input seems to be possible.

NOTE: This works whether using SDUI or HDUI.

I know very little about flash programming but exploring a little more I made a simple "Hello World!" ActionScript 2 script and compiled to swf with the free mtasc compiler and served up the resulting swf to my Premiere via a simple Python web server and verified that it ran.

Don't know if a fully custom flash application responding to various remote control presses is possible and if for example serving up video through flash would be possible as well. Above simple "Hello World!" script is as far as I got. I tried to do a little with event listeners to see if I could figure out how to capture remote control presses but didn't get anywhere with that.

At any rate I thought this was at least mildly interesting and figured I would post here to see if anyone perhaps with more flash experience has an interest in exploring this further. I can post some code for someone to get going on this and replicate what I have done so far if there is any interest.
__________________
Roamio Pro, Elite, Premiere
Cox - Motorola CableCards & TAs
Slingbox 350 via TiVo Mini & TiVo Stream for remote viewing

To view links or images in signatures your post count must be 10 or greater. You currently have 0 posts.


To view links or images in signatures your post count must be 10 or greater. You currently have 0 posts.
moyekj is offline   Reply With Quote
Old 04-16-2012, 09:25 PM   #2
Soapm
Registered User
 
Soapm's Avatar
 
Join Date: May 2007
Location: So close, yet too far away
Posts: 1,477
Very interesting but it's to close to a way to brick your S4 for me to give it a try. And I'm the adventurous type...
Soapm is offline   Reply With Quote
Old 04-16-2012, 11:09 PM   #3
wmcbrine
Resistance Useless
 
wmcbrine's Avatar
 
Join Date: Aug 2003
Posts: 9,042
DUDE.

Yes this is mildly interesting. Moar plz.
__________________

To view links or images in signatures your post count must be 10 or greater. You currently have 0 posts.
wmcbrine is offline   Reply With Quote
Old 04-17-2012, 02:04 AM   #4
moyekj
Registered User
 
Join Date: Jan 2006
Location: Mission Viejo, CA
Posts: 9,098
OK, here's a zip package which I think has all the stuff to get started along with a README.txt summarizing each file:
http://kmttg.googlecode.com/files/TiVoFlash.zip

Basically to get started edit run.bat (Windows) or run.sh (Linux) to set your Series 4 IP and your 10 digit MAK and then just run the script.

Once you have the sheep swf working if you like you can make your own and use webserver to serve it up. Start with provided sample.swf file as starting point. You can test webserver with your browser first.

NOTE: If you give a bad URL you could hangup your Premiere GUI for a while (I've done it a couple of times). Use at your own risk, etc.
It's late so I may have messed up making the package. Let me know if something is missing or not clear.

(NOTE: I would have preferred to keep everything Python for simplicity but I'm not sure how to do socket PKCS12 authentication with Python and since kmttg.jar has pretty much everything needed I was lazy and just used it. Technically current software doesn't need PKCS12 authentication but it will be needed in "Spring" software release so I'm already ready for that.)
__________________
Roamio Pro, Elite, Premiere
Cox - Motorola CableCards & TAs
Slingbox 350 via TiVo Mini & TiVo Stream for remote viewing

To view links or images in signatures your post count must be 10 or greater. You currently have 0 posts.


To view links or images in signatures your post count must be 10 or greater. You currently have 0 posts.
moyekj is offline   Reply With Quote
Old 04-17-2012, 01:26 PM   #5
wmcbrine
Resistance Useless
 
wmcbrine's Avatar
 
Join Date: Aug 2003
Posts: 9,042
Um... source code for TiVoFlash.jar?
__________________

To view links or images in signatures your post count must be 10 or greater. You currently have 0 posts.
wmcbrine is offline   Reply With Quote
Old 04-17-2012, 03:19 PM   #6
moyekj
Registered User
 
Join Date: Jan 2006
Location: Mission Viejo, CA
Posts: 9,098
Quote:
Originally Posted by wmcbrine View Post
Um... source code for TiVoFlash.jar?
I don't have it with me right now, but the bottom line to execute flash is simply an RPC request with following JSON (substitute URL accordingly):
Code:
{"type":"uiNavigate","uiDestinationType":"flash","uri":"x-tivo:flash:URL","bodyId":"-"}
bodyId may have to be TSN but probably "-" as above works.

P.S. I found it by going through return values after querying uiDestinationType of type "flash" with following RPC request:
Code:
{"type":"uiDestinationInstanceSearch","uiDestinationType":"flash","levelOfDetail":"high","noLimit":"true"}
There's some more interesting stuff there if you go through the returned list.
__________________
Roamio Pro, Elite, Premiere
Cox - Motorola CableCards & TAs
Slingbox 350 via TiVo Mini & TiVo Stream for remote viewing

To view links or images in signatures your post count must be 10 or greater. You currently have 0 posts.


To view links or images in signatures your post count must be 10 or greater. You currently have 0 posts.

Last edited by moyekj : 04-17-2012 at 03:28 PM.
moyekj is offline   Reply With Quote
Old 04-17-2012, 11:07 PM   #7
wmcbrine
Resistance Useless
 
wmcbrine's Avatar
 
Join Date: Aug 2003
Posts: 9,042
I couldn't get your package to run on my Mac; it said 'Exception in thread "main" java.lang.NoClassDefFoundError: Main'. Anyway, I took the info from above and put it into a Python script from the "Discovering the iPad interface" thread. I'll worry about PKCS12 authentication later.

The sheep game doesn't play too well, but here's a game that fully works:

Code:
http://91.121.199.16/1980-games/flash4/jeux-reflexion/jeux-flash/reversi.swf
Yeah, of course, I would pick that. Although the first thing I tried (after the sheep) was:

Code:
http://www.homestarrunner.com/trogdor.swf
I can't get past the intro screen, but it's fun to see even that on a TiVo.

I suspect these can also be launched somehow from HME, or perhaps directly from the "Showcases" menu. We still have this one cryptic comment from a guy who never came back.

This is what I'm using for now:
Attached Files
File Type: zip remote3.zip (1.8 KB, 4 views)
__________________

To view links or images in signatures your post count must be 10 or greater. You currently have 0 posts.

Last edited by wmcbrine : 04-17-2012 at 11:34 PM.
wmcbrine is offline   Reply With Quote
Old 04-18-2012, 01:06 AM   #8
moyekj
Registered User
 
Join Date: Jan 2006
Location: Mission Viejo, CA
Posts: 9,098
Still hoping someone that is familiar with Flash can run with this.
ActionScript 2 kind of blows as a language from the little I played with it and apparently is being phased out. ActionScript 3 seems better but a similar "Hello World" swf I created using as3 via FlashDevelop didn't run on TiVo (browser worked fine). There seems to be many kinds of Flash so just figuring out what the TiVo player will or will not play may be a challenge. I guess TiVo is using "Adobe Air" whatever that is (and apparently is not going to be further developed by Adobe).

First step would be to figure out how to respond to remote control presses with eventual goal of trying out video. Really hope that annoying 1.1GB buffer limit is not in play here since that's the real killer of the non-flash HME method (which is copy rather than stream). There must be a way to stream via Flash rather than copy. I figure the upcoming revamped Netflix & YouTube HME apps being talked about in the TCF forums are most likely Flash based and use streaming.
__________________
Roamio Pro, Elite, Premiere
Cox - Motorola CableCards & TAs
Slingbox 350 via TiVo Mini & TiVo Stream for remote viewing

To view links or images in signatures your post count must be 10 or greater. You currently have 0 posts.


To view links or images in signatures your post count must be 10 or greater. You currently have 0 posts.

Last edited by moyekj : 04-18-2012 at 01:12 AM.
moyekj is offline   Reply With Quote
Old 04-18-2012, 11:08 AM   #9
Iluvatar
Registered User
 
Iluvatar's Avatar
 
Join Date: Jul 2006
Posts: 377
Quote:
Originally Posted by moyekj View Post
First step would be to figure out how to respond to remote control presses with eventual goal of trying out video. Really hope that annoying 1.1GB buffer limit is not in play here since that's the real killer of the non-flash HME method (which is copy rather than stream). There must be a way to stream via Flash rather than copy. I figure the upcoming revamped Netflix & YouTube HME apps being talked about in the TCF forums are most likely Flash based and use streaming.
I wouldn't think that would be a problem with FFmpeg and rtmp streaming. Hulu+ is serving up flv files through rtmp (well encrypted rtmp). Would be easy to mux streams into a flv to serve up. The rest of the framework is the real work

edit: I meant to say FFmpeg along with a FMS server. I believe there are a few opensource Python modules that could be used for the purpose.
__________________
My
To view links or images in signatures your post count must be 10 or greater. You currently have 0 posts.
- Read link for changes

To view links or images in signatures your post count must be 10 or greater. You currently have 0 posts.


To view links or images in signatures your post count must be 10 or greater. You currently have 0 posts.
and
To view links or images in signatures your post count must be 10 or greater. You currently have 0 posts.
for OS X

Last edited by Iluvatar : 04-18-2012 at 12:04 PM.
Iluvatar is offline   Reply With Quote
Old 04-18-2012, 10:08 PM   #10
Soapm
Registered User
 
Soapm's Avatar
 
Join Date: May 2007
Location: So close, yet too far away
Posts: 1,477
Quote:
Originally Posted by moyekj View Post
Still hoping someone that is familiar with Flash can run with this..
When you said flash I thought of flashing the prom or one of the chips on the board so I guess I wouldn't be much help...
Soapm is offline   Reply With Quote
Old 04-19-2012, 12:03 AM   #11
moyekj
Registered User
 
Join Date: Jan 2006
Location: Mission Viejo, CA
Posts: 9,098
Quote:
Originally Posted by Iluvatar View Post
I wouldn't think that would be a problem with FFmpeg and rtmp streaming. Hulu+ is serving up flv files through rtmp (well encrypted rtmp). Would be easy to mux streams into a flv to serve up. The rest of the framework is the real work

edit: I meant to say FFmpeg along with a FMS server. I believe there are a few opensource Python modules that could be used for the purpose.
That certainly sounds promising.
So far I've been unable to get any compiled AS3 code to run. Only compiled AS2 code seems to run for me so far. I actually have keyboard event listener working in AS3 code that works when running in a browser.
__________________
Roamio Pro, Elite, Premiere
Cox - Motorola CableCards & TAs
Slingbox 350 via TiVo Mini & TiVo Stream for remote viewing

To view links or images in signatures your post count must be 10 or greater. You currently have 0 posts.


To view links or images in signatures your post count must be 10 or greater. You currently have 0 posts.
moyekj is offline   Reply With Quote
Old 04-19-2012, 12:51 PM   #12
Iluvatar
Registered User
 
Iluvatar's Avatar
 
Join Date: Jul 2006
Posts: 377
Quote:
Originally Posted by moyekj View Post
That certainly sounds promising.
So far I've been unable to get any compiled AS3 code to run. Only compiled AS2 code seems to run for me so far. I actually have keyboard event listener working in AS3 code that works when running in a browser.
I don't profess to know anything about Flash but at one point the Copyright & Trademarks screen under System Info on the TiVo listed AS2 modules being used for its interface. I've heard they are migrating to Air and Flash Lite but I'm uncertain how that relates to the full Flash API versioning as far as feature and scripting compatibility would go.

edit...
__________________
My
To view links or images in signatures your post count must be 10 or greater. You currently have 0 posts.
- Read link for changes

To view links or images in signatures your post count must be 10 or greater. You currently have 0 posts.


To view links or images in signatures your post count must be 10 or greater. You currently have 0 posts.
and
To view links or images in signatures your post count must be 10 or greater. You currently have 0 posts.
for OS X

Last edited by Iluvatar : 04-20-2012 at 09:26 AM.
Iluvatar is offline   Reply With Quote
Old 04-19-2012, 07:48 PM   #13
cyphers72
Registered User
 
Join Date: Jul 2002
Posts: 26
I get no response at all from uiDestinationInstanceSearch. Every other command seems to work. Python script works. Auth and keys work. Have tried setting body_id to the TSN in both the header and body with no luck. The box doesn't reply at all. No error, nothing. Authentication and other keys work like Pause, etc.

I'm calling it this way from the script:

req = RpcRequest('uiDestinationInstanceSearch', uiDestinationType='flash', levelOfDetail='high', noLimit='true', bodyId='tsn:XXXXXXXXXX')

The log output looks sane. I feel like something is missing from the command. Have tried against both an Elite and a normal Premier. Anyone have maybe a raw log output from a working uiDestinationInstanceSearch that is verified against a real box?
cyphers72 is offline   Reply With Quote
Old 04-19-2012, 08:14 PM   #14
moyekj
Registered User
 
Join Date: Jan 2006
Location: Mission Viejo, CA
Posts: 9,098
Quote:
Originally Posted by cyphers72 View Post
I get no response at all from uiDestinationInstanceSearch. Every other command seems to work. Python script works. Auth and keys work. Have tried setting body_id to the TSN in both the header and body with no luck. The box doesn't reply at all. No error, nothing. Authentication and other keys work like Pause, etc.

I'm calling it this way from the script:

req = RpcRequest('uiDestinationInstanceSearch', uiDestinationType='flash', levelOfDetail='high', noLimit='true', bodyId='tsn:XXXXXXXXXX')

The log output looks sane. I feel like something is missing from the command. Have tried against both an Elite and a normal Premier. Anyone have maybe a raw log output from a working uiDestinationInstanceSearch that is verified against a real box?
If using the python script you need to add printing of return values. i.e. After:
result = self.Read()
Add:
print result
__________________
Roamio Pro, Elite, Premiere
Cox - Motorola CableCards & TAs
Slingbox 350 via TiVo Mini & TiVo Stream for remote viewing

To view links or images in signatures your post count must be 10 or greater. You currently have 0 posts.


To view links or images in signatures your post count must be 10 or greater. You currently have 0 posts.
moyekj is offline   Reply With Quote
Old 04-19-2012, 09:47 PM   #15
moyekj
Registered User
 
Join Date: Jan 2006
Location: Mission Viejo, CA
Posts: 9,098
Progress.

AS2 code to get button press keycodes:
keyboard.as
Code:
// Compile: mtasc -swf keyboard.swf -main -header 800:600:20 keyboard.as

class Sample {
   static var app:Sample;
   
   function Sample() {
      // entry point
      // Define text formatting
      var emphatic:TextFormat = new TextFormat();
      emphatic.bold = true;
      emphatic.size = 20;
           
      // creates a 'tf' TextField size 800x600 at pos 0,0
      _root.createTextField("tf",0,0,0,800,600);
      // write some text into it
      _root.tf.text = "HELLO WORLD !";
      _root.tf.setTextFormat(emphatic);
     
      Key.addListener(_root);
      _root.onKeyDown = function() {
          _root.tf.text = "Key Pressed: keyCode=" + Key.getCode();
          _root.tf.setTextFormat(emphatic);
      };
    }

   // entry point
   static function main(mc) {
      app = new Sample();
   }   
}
keycodes derived from above:
Code:
select      13
left        37
up          38
right       39
down        40
0           48
1           49
2           50
3           51
4           52
5           53
6           54
7           55
8           56
9           57
vol up      16777217
vol down    16777218
mute        16777219
chan up     16777220
chan down   16777221
record      16777222
play        16777223
pause       16777224
ff          16777226
rew         16777227
skip forw   16777228
skip back   16777229
enter       16777233

thumbs up   33554439
thumbs down 33554440
info        33554444
slow        33554462
aspect      33554485

APPLICATION EXIT KEYS
Live TV
Guide
TiVo
Clear
Sample AS2 code to embed a YouTube video:
movie.as
Code:
// Compile: mtasc -swf movie.swf -main -header 800:600:20 movie.as
class Sample {
   static var app:Sample;   
   function Sample() {
      _root.createEmptyMovieClip("video_mc", _root.getNextHighestDepth());
      _root.video_mc.loadMovie("http://www.youtube.com/v/b694exl_oZo");
   }

   // entry point
   static function main(mc) {
      app = new Sample();
   }   
}

__________________
Roamio Pro, Elite, Premiere
Cox - Motorola CableCards & TAs
Slingbox 350 via TiVo Mini & TiVo Stream for remote viewing

To view links or images in signatures your post count must be 10 or greater. You currently have 0 posts.


To view links or images in signatures your post count must be 10 or greater. You currently have 0 posts.

Last edited by moyekj : 04-20-2012 at 12:37 AM.
moyekj is offline   Reply With Quote
Old 04-20-2012, 05:49 AM   #16
cyphers72
Registered User
 
Join Date: Jul 2002
Posts: 26
Got it working, thanks.

Looks like the tunerStateEventRegister call has changed since the initial research last year. It now complains "Must specify monitoring." Anyone know what to pass for that? The error is mentioned in the old thread, but none of the samples use it so I assume this was a software change. I've tried passing "true" and "foreground" with a "monitoring" parameter but no dice.
cyphers72 is offline   Reply With Quote
Old 04-20-2012, 09:16 AM   #17
moyekj
Registered User
 
Join Date: Jan 2006
Location: Mission Viejo, CA
Posts: 9,098
Quote:
Originally Posted by cyphers72 View Post
Got it working, thanks.

Looks like the tunerStateEventRegister call has changed since the initial research last year. It now complains "Must specify monitoring." Anyone know what to pass for that? The error is mentioned in the old thread, but none of the samples use it so I assume this was a software change. I've tried passing "true" and "foreground" with a "monitoring" parameter but no dice.
As defined in python script the 'monitor' parameter is type Boolean not string so should be either True or False (which in turn will set ResponseCount in header to either 'multiple' or 'single'). So in this case you should set it to True. I use this one in kmttg so I know it works.
__________________
Roamio Pro, Elite, Premiere
Cox - Motorola CableCards & TAs
Slingbox 350 via TiVo Mini & TiVo Stream for remote viewing

To view links or images in signatures your post count must be 10 or greater. You currently have 0 posts.


To view links or images in signatures your post count must be 10 or greater. You currently have 0 posts.
moyekj is offline   Reply With Quote
Old 04-27-2012, 12:09 AM   #18
moyekj
Registered User
 
Join Date: Jan 2006
Location: Mission Viejo, CA
Posts: 9,098
So I take it nobody has pursued this further? My challenge to someone willing to look into it further is to get full screen FLV video via ActionScript 2. Bonus points for some basic trick play functionality included (keycodes for most TiVo remote buttons are posted above). Double bonus points for using streaming instead of loading a whole movie. One would think that would be trivial since after all Flash was designed with video in mind but I found AS2 language extremely poor and unintuitive and spent half a day searching for a way to do it and found nothing. Little wonder AS2 was abandoned in favor of AS3 but of course leave it to TiVo to apparently only support the older/crappier AS2. I knew nothing about Flash stumbling into this functionality and now I'm starting to see why Steve Jobs never endorsed it...
__________________
Roamio Pro, Elite, Premiere
Cox - Motorola CableCards & TAs
Slingbox 350 via TiVo Mini & TiVo Stream for remote viewing

To view links or images in signatures your post count must be 10 or greater. You currently have 0 posts.


To view links or images in signatures your post count must be 10 or greater. You currently have 0 posts.
moyekj is offline   Reply With Quote
Old 05-06-2012, 07:00 PM   #19
moyekj
Registered User
 
Join Date: Jan 2006
Location: Mission Viejo, CA
Posts: 9,098
FYI, I did find an example of getting flv video playback via AS2 using FlashDevelop IDE from here:
http://www.flashdevelop.org/communit...pic.php?p=1583

Specifically the FlashDevelop project can be downloaded here:
http://flashdevelop.org/downloads/do...mple-1.0.0.zip

(Important part to note is the video object swf is compiled from xml file using "swfmill" as you apparently can't define a video object directly in AS2 for some stupid reason).

Works fine in Adobe Flash player and web browser, but on TiVo just the text shows up, not the video portion...
__________________
Roamio Pro, Elite, Premiere
Cox - Motorola CableCards & TAs
Slingbox 350 via TiVo Mini & TiVo Stream for remote viewing

To view links or images in signatures your post count must be 10 or greater. You currently have 0 posts.


To view links or images in signatures your post count must be 10 or greater. You currently have 0 posts.
moyekj is offline   Reply With Quote
Old 05-16-2012, 02:34 AM   #20
cyphers72
Registered User
 
Join Date: Jul 2002
Posts: 26
I think the mdns trace code will need to be revived. With data that is somewhat old now, the last comments were that the mdns SSL MITM trace code from arantius didn't seem to work with 1.5 yet. As it's now 1.9.1, I think some things have changed. I noticed various windowing-style behaviors that are unexplained. The Flash thing you mention sounds like one of those where you may need to tell the UI navigator where to be first.

In particular, I can't figure out how to change channels -- other than sending 4 separate key events of course. This can obviously be performed via the API and the official app does it, but the traces seem to have captured only how to navigate to a recording. Given the ability to get fresh data from the app, I think virtually any question could be resolved.
cyphers72 is offline   Reply With Quote
Old 05-26-2012, 06:27 PM   #21
cyphers72
Registered User
 
Join Date: Jul 2002
Posts: 26
Got the "Spring Update" aka 20.2.1 and it now requires an SSL client-side certificate to connect. So everything that uses mindrpc is now officially and completely broken.

Will need to figure out if it actually cares what cert is used or if anything works. Worst case scenario it only takes the cert embedded into the TiVo app which means it could in principle be extracted of course.
cyphers72 is offline   Reply With Quote
Old 05-26-2012, 07:13 PM   #22
moyekj
Registered User
 
Join Date: Jan 2006
Location: Mission Viejo, CA
Posts: 9,098
See post #4 of this thread. I already knew about the new PKCS12 authentication and warned about it and kmttg was updated a while ago to deal with it as was the zip I posted above. If you still want working Python code then you'll have to figure out how to do PKCS12 authentication with Python. The relevant Java code with the all important password you can find here (see method createSocketFactory):
http://code.google.com/p/kmttg/sourc...pc/Remote.java
zip file in post #4 has the "cdata.p12" PKCS12 client side file.

Of course none of what you are doing is really relevant to executing Flash on Series 4 units which is what this thread is about. At this point we'll likely just have to wait for the official TiVo SDK release to see if there is anything interesting there. Haven't looked at this in a while but I couldn't get AS3 code to run via this method of executing Flash, only AS2 code seems to run and I couldn't get video object working there. Most likely the official SDK will be AS3 based.
__________________
Roamio Pro, Elite, Premiere
Cox - Motorola CableCards & TAs
Slingbox 350 via TiVo Mini & TiVo Stream for remote viewing

To view links or images in signatures your post count must be 10 or greater. You currently have 0 posts.


To view links or images in signatures your post count must be 10 or greater. You currently have 0 posts.

Last edited by moyekj : 05-26-2012 at 07:20 PM.
moyekj is offline   Reply With Quote
Reply
Forum Jump




Thread Tools


Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

vB code is On
Smilies are On
[IMG] code is On
HTML code is Off

Advertisements

TiVo Community
Powered by vBulletin® Version 3.6.8
Copyright ©2000 - 2014, Jelsoft Enterprises Ltd.
vBulletin Skins by: Relivo Media

(C) 2013 Magenium Solutions - All Rights Reserved. No information may be posted elsewhere without written permission.
TiVoŽ is a registered trademark of TiVo Inc. This site is not owned or operated by TiVo Inc.
All times are GMT -5. The time now is 05:40 PM.
OUR NETWORK: MyOpenRouter | TechLore | SansaCommunity | RoboCommunity | MediaSmart Home | Explore3DTV | Dijit Community | DVR Playground |