INTRODUCTION: In December 1997 WNI introduced the first WTV Plus box. This was a major improvement over the old 1996 WTV box which was then dubbed the "Classic". The Plus had a faster CPU, more memory... 8 megs instead of 2, 56k modem instead of 33.6k, and it integrated TV with the web. WNI also introduced what they called a "video modem" which could extract data from the TV signal itself... similar to how Closed Captioning works.
On the TV side the Plus provided one, then seven days of searchable TV listings and the Plus could also be used to control a VCR. What WNI didn't tell its subscribers was that in February '98 WNI had made a deal with Neilson to steal our TV viewing data. We had to learn that in the press.
The Plus also had, for the first time, a hard drive (HD). One critic quiped the space was essentially for rent to advertisers. At 1.08 gigs, the hard drive was small by the day's PC standards, but it was sufficient for the types of applications intended for a settop internet box. In late '97 WNI talked of using the Video Modem and the hard drive to download movies at night for viewing them the next day... a primative form of "Video on Demand". Some have considered this to be Vaporware. But a stronger case could be made that it was unworkable.
THE PLUS1.5: THE DERBY In fall of '98 it was learned WNI was beta testing a new Plus code named the "Derby". To avoid confusion I will refer to the original Plus as the Plus1 and the Derby as Plus1.5. It seemed at the time WNI was determined to introduce a new box each year. There was also talk of a box that would run on Windows CE.
The Derby was to have a faster CPU and more memory than the Plus1, and would have a softmodem.
By the late spring of '99 WNI talked of a new Plus... this one without a hard drive. For purposes of this discussion it will be dubbed the Plus2. This begged the question: what happened to the Derby? As it turned out a variation of the Plus was quietly introduced in early '99.
The Derby Plus1.5 obviously started out to be more ambitious.... the replacement for the Plus1. What resulted was a box with the new modem, but the CPU speed increase was negligible and there's no evidence of any increase in memory. In fact Sony, for one, did not even even bother to issue the box a new model number! WNI may have feared that to announce the upgrade would have forced a price cut on the older Plus1. No one in their right mind would have paid the same price for a discontinued model. If you are unsure what box you have you can find out using te 411 Power-Off code. If there is mention of a "soft modem" on the TechInfo Page, it is the newer Derby box.
If one had to speculate about Derby's strange journey it might be safe to assume the Derby was too far along in development to scrap, but WNI had decided to create an even newer replacement for the Plus. It was to have 16 megs of ram, not just 8. Also of note: unlike the Plus1 and Plus15, it would not have HD. WNI claimed many users did not like the HD's whine and noise. In an era of dropping memory prices, the HD was also more costly. Not counting the DishPlayer, only the Plus1 and the Plus1.5 had hard drives. The question was... what was on them.
HACKING THE HARD DRIVE: When the Plus1 was introduced in late December '97 no doubt some were trying to get access to the HD's files right from the beginning. The first post I recall on the topic was by REDXI... a co-creator of the then famous WTV-MADNESS site. RedXI had identified some of the directories on the HD.
Group: alt.discus.webtv.madness Date: Sun Feb 1, 1998 (EST-3) From: RexXI@webtv.net (Nelson Kulz) URLs To Plus Hard Drive Found!!! Okay, I don't know any of the file names on it yet. All I know is three directories located on it. Come on tricksters and all alike. We can find a file!!! MAIN DISK: file://disk BROWSER DIRECTORY: file://disk/browser/ TV SUB-DIRECTORY: file://disk/browser/tv/ There is one trick with the TV sub-directory but I don't know the ending to the filename. The address is file://disk/browser/tv//listing****** It might be: file://disk/browser/tv/listings****** Either way... whatever comes after that word... I don't know. The last trick I have found with the Plus, is a way to toggle the PIP (the client: address) javascript:window.open("client:TogglePIP"). Remember, that it must be performed on a WebTV page. Please visit WebTV Madness. RedXI... over and out. Ii working on this history I phoned REDXI and he later expanded on what happened: From: XXXXX3@earthlink.net Date: Thu, Apr 27, 2000, 8:40pm (EDT-3) To: ulTRAX@webtv.net Subject: The Full Story *g* Anyway, when WebTV madness was around, we had a way to get most of our pages. You see, an early version of one of our pages went "glitchy" on us, we started getting disoriented jibberish. But, within these lines of code, to quote the movie 'Contact', lies the key to unlocking it ;-) I discovered there were actually filenames embedded in if you looked close enough, for instance: aF2dromcache/image.jpga--#@*file://*2Zx(@@romcache/browser/tv-listings etc. A classic and + edition WebTV would both be found to respond differently in this gibberish page. The WebTV+ almost _ALWAYS_ showed lines of nonsense text. But occasionally a filename would pop up. I was so quick to hit back though, I almost missed it sometimes. All I can really remember was something of this nature: file://rom/browser/tv//listings/xxx My personal believe is that the term 'ROM' would be out of place. ROM is really just a symbol which leads to the hard drive. I am aware of others attempts to list the directories, etc. Here is my belief on the plus directory structure... ROM (All files on hard drive in in hard-code) Browser (All files related to browser) TV (All TV-Related files) IR, etc. (Special data files, usu. unvarying) Listings (Temp storage, etc.) It's probably changed, after all I did it two years ago. Oh well, have fun -- RedXI
What is curious is that REDXI had accessed some of the HD's directories... yet when I tried his URLs all I got was for the HD to come on. Prior to the 2.2 upgrade in the Summer of '98, the HD only ran periodically when retrieving files. I never got to any page as he did.
It late March 98 there were some posts about the ROMCACHE files... But when the URL was accessed, most of the resulting page was mostly jibberish. In late April one person claimed to have accessed new 600 URLs in ROM, but when push came to shove, they were never able to demostrate this. He finally posted a public retraction. One may now wonder whether he had decoded the alt-key gibberish as did REDXI.
Frustrated with the slow progress in this area I posted a series called "Assault on Fortress ROM" hoping to garner interest in an organized effort to get into the ROM and HD files. But there was little interest and no progress.
Getting into the HD was an issue that would not go away: it was too damn important. It wasn't until August that MirrororriM was willing to pull his HD out of his box and see if the files could be read by a PC. He writes:
Basically, I took the unit apart and took the HD to a friends house. We took out his HD and replaced it with a WebTV HD. When he booted the computer up, we got a bunch of jumbled up (what I thought at the time) garbage with a few actual words in it that I didn't understand at the time. It seems that it was basically what you guys are getting now with eat_meimacookie's method. I'm jealous! LOL! That's all that really happened. We shut the computer down almost immediately because we didn't know what was going on.
These efforts to decompile the HD proved disasterous. Four to five boxes were reported lost. And so the matter languished... not that there were not advances being made on other fronts.
REINVENTING THE WHEEL: In late January '99 eat_meimacookie apparently revisited those jibberish alt-key pages. In retrospect, what he saw was something we failed to appreciate a full year before. This failiure to take advantage of what REDXI discovered has to go down as one of our greatest lost opportunities.
Once this decoding was understood, progress in mapping out the HD's file structure was fairly easy... although in the process it began to turn up so many directories and file names it was difficult to keep up.
DECODING FILE:// PAGES: This decoding technique has proven to be one of the big WTV Hacking discoveries. It opened up the Plus HD so we can finally see its File structure. What the technique does is allow us to see all the subdirectoires contained in a directory. From there we can use those subdirectory names to get the next level. At some point we end up with a final file, be it a midi, a image, a html page, or raw code. Just keep in mind that what you see will probably seem like pure "jibberish". If you access FILE://DISK/BROWSER/TV/IR/ you get something that looks like this mess: S'%í.. S'%äå.GROUÐP-UPDATEåROUP-~1 S'%AcabcoÛdes.datCABCODESDAT$S'%céAvcrco!des.datVCRCODESDAT/S'%=Asatcoádes.datSATCODESDAT1S'%oÆAcabnañmes.datCABNAMESDAT 2S'%nMAvcrna×mes.datVCRNAMESDAT4S'%y'Asatna˜mes.datSATNAMESDAT5S'%xÝAdelayr.datÿÿÿÿÿÿDELAY DAT5S'%‚
But, note there are real words embeded in this jibberish. Take those words and add them to the original URL to get: file://disk/browser/tv/ir/delay.dat/ file://disk/browser/tv/ir/satnames.dat/ file://disk/browser/tv/ir/vcrnames.dat/ file://disk/browser/tv/ir/cabnames.dat/ file://disk/browser/tv/ir/cabcodes.dat/ file://disk/browser/tv/ir/satcodes.dat/ file://disk/browser/tv/ir/vcrcodes.dat/ Note: at times you may get a error message saying the file "contains a type of information WTV can not use". If you get this just try adding a backslash or two on the end of the directory or URL. Also, not all Plus HD have the same directories. For example, if you do not have DOOM loaded on your HD, no matter how much you try to access FILE://DISK/DOOM/, you will only get error popupssaying the file is missing a publisher's address.
DOWNLOADING FILES: To complicate matters even more Eat_me also discovered he could manually download files from Download-a-Rama. This was not just breakthough in understanding the box, but also resulted in hundreds of new URLs. Even more exciting was discovering that we might be able to not just download DOOM and Jack, but unreleased features such as RA5 and MS Netshow aka MS MediaPlayer.
MXW FILES:However, downloading files was not as productive as it might have been. Many file directories had a curious MXW file extension. TO BE CONTINUED
Group: alt.discuss.webtv.hacking Date: Mon, Apr 10, 2000 From: ulTRAX@webtv.net Re: BLUNDERS: Plus1 HD Files I have a copy of an old post dated 2-1-98 from REDIX... one of the people behind the WTV-MADNESS site. At that time he said he had found the file://disk/browser directory.. as well as some subdirectories file://disk/browser/tv/ file://disk/browser/tv/listings For reasons unknown, this was never exploited (I know I could not get to them at the time) yet it should have started a massive effort to explore the then new Plus1. It wasn't until a year later that this whole topic was revisited... this time because of eat_meimacookie. Group: alt.discuss.webtv.hacking Date: Mon, Apr 10, 2000 From: GrimIo@webtv.net (g™ / rimio) Re: BLUNDERS: Plus1 HD/ROM Files (ulTRAX) So who should be rightfully credited with finding how to access/decode files/directories? REDIX or cookie? There are whole sections of our box such as the file://rom/Test/ and file://rom/Phone/ directories that probably 1 in 50 people here have ever heard of. If you ask me, I think it's the right time to release all the files that Eric Mac found. I'll post them later. Someone on WebTV had found the exact same files on his Dish-Player along with the screen saver file with his own method a few months _before_ Eric did. The screen saver was something "afterdark". He had even found phone numbers for head offices at Microsoft code named after "The Flintstones" characters. If you're reading this, would you like to post your findings? Group: alt.discuss.webtv.hacking Date: Mon, Apr 10, 2000 From: ulTRAX@webtv.net Re: BLUNDERS: Plus1 HD/ROM Files (grim) It would seem that REDXI has to get some of the credit... He either was a VERY good guesser or was the first to actually realize the jibberish were subdirectory names. I remember writing him at the time but don't remember if he repsonded. The only response I ever got out of my box at the time was the HD would come on. These were the days when the HD did NOT run constantly. At the time, since I could not access anything, I assumed that's how he knew he found the subdirectories.... by guessing names and listening for the HD to come on. Group: alt.discuss.webtv.hacking Date: Mon, Feb 22, 1999 From: ulTRAX@webtv.net I'M PISSED Three weeks ago eat_meimacookie discovered a way to FINALLY map the disk file structure of the Plus HD. One might think that there would have been post after post of new discoveries.... afterall, this is a God damn Hacking NG and getting into the HD has been a long time goal. But, no. For the most part this group is still full of the same off topic bullshit. Anyway.... for those up for a little challenge.... below is my directory of TV logs in which is private information about my family's TV viewing. It pisses me off no end that each night WTV steals this info from our home. It is one of my goals to get into these logs and eventually disable them. Anyone who likes to think of themselves as a hacker or values their own privacy should also be interested in doing the same. Note that YOUR file names may be different but the directory in which you'll find them should be the same As below. Presumably, these files must somehow be properly decoded to be accessed. What final form that takes... who knows. file://disk/browser/logs/tv/36D18D2FLOG ? file://disk/browser/logs/tv/LOG36D18D2F ? file://disk/browser/logs/tv/36D18D2F.log ? Directory: FILE://DISK/BROWSER/LOGS/TV/ MY FILES: KU'%â.. KU'%áA36d12Ìff3.log36D12FF3LOGÕRV&åWA36d16M67b.logLOGS/dirëqV&èA36d17310.log36D17310LOG"yV&é8A36d18ë596.log36D18596LOGƒƒV&6´A36d18Ûc73.log36D18C73LOG+‡V&ŒOA36d185d2f.log 36D18D2FLOGˆV&"6A36d1bî6bf.log36D1B6BFLOG9ŸV&Æ°A36d1bÓa34.log36D1BA34LOG'¡V&ÇEA36d1cB7fe.log36D1C7FELOGm©V&É7å36cdeÅ1e2.logå6CDE1E2LOG™±S&®å36cdeÝbf1.logå6CDEBF1LOGö¶S&=å 36cdfÛ2fe.logå6CDF2FELOG9»S&®å36cdf°a10.logå6CDFA10LOG¿S&^å36cdfSa7d.logå6CDFA7DLOG8¿S&§å36ce0t07b.logå6CE007BLOGëT&8å36ce3ž660.logå6CE3660LOGª!T&®å36ce4µf7f.logå6CE4F7FL OG0T&7å36c90:089.logå6C90089LOGÈ*P&6å36c38Þd06.logå6C38D06LOGL&¯å36c39ë3f8.logå6C393F8LOG¶L&6å36c399750.logå6C39750LOG€L&Aå36c39Ja12.logå6C39A12LOGwL&Aå36c3aä2ab.logå6C3A 2ABLOGL&Cå36c3c5dd.logå6C3C5DDLOGR1L&Då36afeH64a.logå6AFE64ALOGó"<&6å36afeç6d6.logå6AFE6D6LOG=#<&Bå36afejddf.logå6AFEDDFLOGý&<&å36aff¬8f6.logå6AFF8F6LOGi-&7å36819001logå6 819001LOGf˜%Òå36819-67e.logå681967ELOG[%Aå3681aâ113.logå681A113LOG˜%1å3681adcb2.logå681ACB2LOG³˜%ªå3681aecf8.logå681ACF8LOGؘ%Öå3681aEe5c.logå681AE5CLOG˜%Aå3681bÇ077.logå681B0 77LOG5˜%?å3681f`a95.logå681FA95LOG=C˜%1 Group: alt.discuss.webtv.hacking Date: Tue, Feb 23, 1999 From: ulTRAX@webtv.net OVER 300 NEW URLS Thanks in part to eat_meimacookie and moneymanC4, over 300 new URLs have been found on the Plus HD in just the past few days.... and there easily could be 300-400 more. For a peek visit http://members.tripod.com/~ulTRICK/index2.html and go to FILE://DISK Group: alt.discuss.webtv.hacking Date: Wed, Feb 24, 1999 From: ulTRAX@webtv.net Re: OVER 300+65 NEW URLS Just got some new DOOM codes from SeqretOne. They include some DOOM midis. Apparently we all don't have the same file:// subdirectories on our HD. Seqret did not have two that I had.... a midi and a mod directory. ~ INDEX ~