Log of exploring the Scientific Atlanta DVR 8000 Unit

Explorer 8000

INTRO
In our cable area we have TimeWarner. Recently (April, 2003) the cable company released a DVR ability. You can order this unit for an extra $10 a month (if you already have digital cable). But since this isn't a Tivo or ReplayTV we wanted to know more about it. There wasn't much out on the internet yet about this so we decided to document our research here. Anyway, hope this helps anybody who is curious about this unit.

Documents and Tech Sheets about the Explorer 8000

Explorer 8000 Tech Sheet DataSheet (3 pages)
Explorer 8000 Remote Control Tech Sheet
Developers Guide (72 Pages)
DBDS System Overview (35 Pages)
DBDS API (86 Pages)
PowerKey System Overview (7 Page)
Business Operating Support System (124 Pages)
Business Applications Support System (65 Pages)
PowerTV OS Overview (441 Pages)
PowerTV Application Development API (1,112 Pages)

This is the information I get when going to console status menu about my device:
(Passport>Echo) 1.0.069
OS - PowerTV 6.0.7sp(5)
Fwd Lvl: 119Mhz2dbmV Rev Lvl: 11Mhz33dbmV

This menu can be accessed when you first turn your device on. (TODO: List steps)
On the back there is a sticker. On it appears to be a MAC address so it may be good to jot that down.

The unit itself is sealed with basic security hex screws. You can get bits from JackStuff.com If you don't already have some.

DATASHEET
Reverse Path DAVIC Data Transmitter
  • Two-way IP communication between set-top and headend
  • Supports Web Browsing and Email
  • Transmition speeds up to 1.544 Mbps
MPEG-2 MP@ML Standard MPEG Decompression
80 Gig Drive 50 Hours Recording Time
DUAL Tuners and MPEG Encoders Allows recording of two things at once
32-Bit RISC Processor 2 164 MHz Processors
PowerTV OS Remotely Upgradable OS
8 MB Flash Stores OS and resident Applications
16 MB DRAM Stores Applications
8 MB DRAM For MPEG Decoding Graphics
16 MB DRAM For MPEG Encoding
8 KB non-volatile memory Stores user settings
PowerKey Access System Handles RSA Key pairs
Internal Security Microprocessor and Smart Card Slot Hardware assisted conditional access method
Macrovision Support Supports MSO restrictions
USB Port For connecting input devices (Keyboards, Mice, Digital Cameras, etc)
Dual IEEE 1394 Interface Supports 400 Mbps interconnection to devices such as HDTV, hard disks, camcorders, etc
Images
Inside of the Explorer 8000
The Hardrive unit
The Hardrive Unit attached to a Linux Box

Steps I took
I know that TimeWarner will disable the unit if it is unplugged for a prolonged period of time. So, what I came up with was a simple method to boot the drive glean some information off of it at bootup then burn the drive to a CD-ROM so I could peruse the data while watching movies on the DVR ;)

Bootup
I booted my local desktop linux box with the drive attached. This device would register as hdc. Here are the steps and commands I entered:

dmesg | grep -i hdc
   ide1: BM-DMA at 0xfc08-0xfc0f, BIOS settings: hdc:DMA, hdd:pio
   hdc: Maxtor 4R080L0, ATA DISK drive
   hdc: 160086528 sectors (81964 MB) w/2048KiB Cache, CHS=9964/255/63, UDMA(33)

fdisk -l /dev/hdc
Disk /dev/hdc: 81.9 GB, 81964302336 bytes
255 heads, 63 sectors/track, 9964 cylinders
Units = cylinders of 16065 * 512 = 8225280 bytes

Disk /dev/hdc doesn't contain a valid partition table
xxd /dev/hdc | head
0000000: 0000 0000 0000 0000 0000 0000 0000 0000  ................
0000010: 0000 0000 0000 0000 0000 0000 0000 0000  ................
0000020: 3412 7856 0000 0004 0000 0a00 1000 0000  4.xV............
0000030: 0e00 7b82 0100 857d 12fa 13de e54f 7b6a  ..{....}.....O{j
0000040: 1000 0000 0000 0100 0000 0100 65b1 2cf1  ............e.,.
0000050: 0000 0000 0000 0000 0000 0000 0000 0000  ................
0000060: 0000 0000 0000 0000 a4d4 731e 0000 0100  ..........s.....
0000070: 0040 0000 0000 0000 0000 0000 0000 0000  .@..............
0000080: 0000 0000 0000 0000 0000 0000 0000 0000  ................
0000090: 0000 0000 0000 0000 0000 0000 0000 0000  ................
It appears that the device is being used as a raw device. And no real obvious signs as to what filesystem is being used altho I suspect it is a proprietary one like Broadband File System (BFS). Don't forget that we can't just leave this unplugged all day. Grab a CD sized chunk of the drive with this command:

dd if=/dev/hdc of=dvr.img bs=1M count=650

Then burn it to CD w/ your favorite burner so you can share it amongst your friends :) I used K3B to burn mine. Now screw the lid back on and plug the unit back in before time warner notices it was offline.

The Data Analysis

Fist thing I did was run strings against it. I saw several English like strings but something was up and it took me a second to notice what.

Example String: iTemt onitiD RVd irevsr :53s cenosd

This was too close to a sentence to be a coincidence. So I stared at it for a few seconds and realized that every other letter was inveresed. iT becomes Ti, em becomes me, etc. So the above line translates to:

Translated line: Time to init DVR drivers: 35 seconds

I imagine this is because the actual unit has a RISC processor and perhaps this is a high order bit issue. Any way this line appears to come from a log file of some sort. The real interesting thing is when you decode a large chunk around this line you get:

04/15/03 13:54:28  avfs_InitSoftThrd  : Time to init DVR drivers: 35 seconds
04/15/03 14:31:33  Unit:0 Time:   45803 Unc:   11389 D:00 F:00,       0h AVDiscs: 00 MaxW:      10 LastW:       0 DmaDisc:00 C:       0 E:       0
01/01/96 00:00:13  avfs_InitSoftThrd  : Time to init DVR drivers: 4 seconds
01/01/96 00:00:12  avfs_InitSoftThrd  : Time to init DVR drivers: 3 seconds
05/10/03 11:23:07  avfs_InitSoftThrd  : Time to init DVR drivers: 4 seconds
05/10/03 11:58:55  Unit:0 Time:   59794 Unc:     993 D:00 F:00,       0h AVDiscs: 00 MaxW:      16 LastW:       2 DmaDisc:00 C:       0 E:       0
05/10/03 12:29:32  Unit:0 Time:   59821 Unc:    1264 D:00 F:00,       0h AVDiscs: 00 MaxW:       D LastW:       2 DmaDisc:00 C:       0 E:       0
05/10/03 12:37:26  Unit:0 Time:   59877 Unc:    1264 D:00 F:00,       0h AVDiscs: 00 MaxW:       B LastW:       2 DmaDisc:00 C:       0 E:       0
05/10/03 12:37:31  Unit:0 Time:       0 Unc:    1264 D:00 F:00,       0h AVDiscs: 00 MaxW:       0 LastW:       0 DmaDisc:00 C:
Now I got my DVR around 5/15. Interesting...

By now you've probably realized that I didn't decode this by hand. I wrote a small little C program to do this for me. It is available here. I then took a small chunk (50 Megs) and transposed the entire thing. Wow did that make strings output much nicer :)

There are lots of logs and what not. So the next section I release will probably be conclusions and tools. It may be useful to note that PowerTV may be based on AvSYS based on some of they system files present.

It would be really nice to have the header files for avsys's filesystem but alas, I don't currently have them. And my research thus far has ended. I will be willing to post anything new that people find. Here is a log extracter for the DVR unit.

Extractlogs.pl - Extracts a week worth of logs and the system log. Data needs to be run through transcode first.