Control Fios Boxes over IP

[willieb]

Don't know if anybody saw this, but it looks to me like verizon and motorola are teaming up to create apps for some verizon phones (imagio and droid for now, but I don't see any reason why it should be limited) that will let you control your fios boxes over wifi (which I take to mean with regular IP commands). I think this would be an excellent alternative for people using usb-uirt or firewire for control. It seems like it could be pretty robust. If it is sending IP commands, it should be pretty easy to sniff the commands and reverse engineer this thing, right? I also suspect it cold spread to cableco boxes in the near future for competition reasons alone. Let me know your thoughts. Thanks.

[Zippster]

I own a Droid and frequent sites for it, many threads about people already using this app Verizon Fios Mobile Remote and LOVING it.

I have fios and home phone through them, was cheaper at time of signup though for me to keep cable for TV as they require set top boxes at each location so I would either have to lose some less used TV's or pay more, a couple promo's they have going now though that I may be signing up for.

[ChaOConnor]

I have FiOS and a Droid, this app is awesome! You can also "beam" pictures from your phone direct to your TV that the STB is attached to. You have to be on the same network as the STB (makes sense).

I could run some tests if people like. Anyone have any ideas on the best way to capture the network data? What do people use, Wireshark? not even sure anymore.

[aflat]

Yeah, wireshark is still the way to go. What was involved with setting this up? Did you need to do anything on the FIOS box? If not, we may be able to play using a druid emulator, not sure though.

[ChaOConnor]

Druid emulator? Is that a new 4E ruleset, I know they got bastardized in 3e, but come on, emulating a druid? ;-) j/k

On the FiOS box you have to install the "widget" and then it sends a command out to your droid that is running the remote app. You allow the connection and you're in. I haven't used the android emulator, if it can mimic the wifi connection and actually see your WLAN, it may work.

I'll setup wireshark tonight if I can and see if I can capture some network data.

[ChaOConnor]

Installed Wireshark tonight, tried to capture my STB, but whenever I try to capture anything other than the local host it crashes.

I know this is more of a Wireshark question, but can anyone give me the basics of feeding Wireshark an IP or MAC Address and telling it to capture all data on the network to/from that IP/MAC?

Thanks!

[bthurber]

Originally Posted by ChaOConnor

I know this is more of a Wireshark question, but can anyone give me the basics of feeding Wireshark an IP or MAC Address and telling it to capture all data on the network to/from that IP/MAC?

Thanks!

host <ipaddress> in the capture filter. for example

host 10.4.2.6

[ChaOConnor]

This is what I got, not much... tried running a few commands, sent a photo to the STB, etc. But I didn't get more than three entries. Perhaps I did something wrong. Anyway, someone want to take a look at this and let me know?

[aflat]

So did you have to hook up the box to a network, or are you still just using coax to the box? By loading the widget, I assume you had to give it your phone number?

[ChaOConnor]

They way the FiOS box works is, it's connected to the modem in my basement via the coax. It's given an IP through the coax and is addressable on the network. If for instance you shut the router off downstairs, the TV will still work, but not the VOD or even the guide I believe. the STB does have an ethernet, but according to the diag menu, it's disabled.

As a side, the firewire is enabled and it appears 5C is disabled as well.

[Fuzzy]

Honestly, if 5C is disabled, and the firewire is working, who cares about contorlling it via IP. I'd just use firewire for controlling AND capturing...

[ChaOConnor]

I haven't even tried Firewire yet. In the course of investigating the IP idea I came across that, but point well taken. However, it's still an interesting academic question for instances where 5C is enabled.

[Fuzzy]

well, even with 5C enabled, the firewire ports should still be able to be used for control, they just can't carry the video back to the server.

[aflat]

I use firewire for control, it even allows you to do things like push up/down/select, so i can choose VOD over it. It's not perfect though, as I can't get it to use a leading 0(fios has 4 digit tuning) and I can't use a 64bit OS. If I could use ethernet, I could go to a 64bit os, and maybe allow me to use 4 digits when tuning. Plus it would allow me to use a VM as well. You can't use firewire in a VM.

Your capture doesn't show it really doing much, could you try changing channels or something like that?

[ChaOConnor]

Aflat, I tried changing channels, using the guide, etc. that's all I caught. I'll try again tonight if I have a chance.

Regarding the FW, I suppose when I do that, things like On Demand don't work, right?

[Fuzzy]

Sage isn't very well suited to ondemand anyways... some have created workarounds, but they are cludgy at best. Sage is now you ondemand...

[aflat]

I use firewire to order VOD, but it's pretty manual for me, I have to be remoted into the machine in the basement to do it. I can't do it from the HD200. There are ways, I just haven't worked too hard at it.

I have the emulator set up, it was easy, but the hard part is trying to get an app from the marketplace into it. I can't find a way to download a apk file from the market, and the emulator doesn't have access to the market, so I have to figure something out.

[rawdod]

Hi, I just wanted to say, I have reverse engineered much of the protocol used to control the FIOS cable boxes over IP. However, there is part of the protocol I don't understand, and it is preventing the boxes from executing the commands that I send them! If this part was understood, all functionality of the FIOS mobile remote would be possible by any computer and automated if desired.

As some proof of my work, here is the image that the fios mobile remote sends to the box when connecting: http://images.rawdod.com/16906-original.png

If anyone is interested or has some network protocol reversing experience, contact me or reply to this thread!

I have cross posted some of this information in three other places:

http://www.reteam.org/board/showthread.php?t=2644

http://www.avsforum.com/avs-vb/showthread.php?t=1253136

http://site.rawdod.com:1666/posts/18867

Thanks!