A bank of modems at one of the WebTV data centers answers, and a TCP connection is established. This initiates the process of creating a Tellyscript. The TellyScript process verifies that the call is coming from a WebTV box (using the SSID?) and then connects to an Automatic Number Identifcation (ANI) server. The server uses user's phone, which is embeded in all 800# calls. This is used to determine the user's area code and telephone local exchange. That data is then used to access a database of local dialup numbers. This and other connection parameters are downloaded to the box. (Note: Anyone who has ever visited JIFFYPOP-O-RAMA has seen the cost calculations for all the local Points of Presence (POP) dialups in one's area.)
Downloaded parameters include an encryption key. Just what the function of this key is, is not known. Also downloaded is the IP addresses and TCP port numbers of all WebTV services. If you are a Plus user, your current list is available at Client:ShowServices. While this IP list must also exist on the Classic, no one has yet been able to access it.
After downloading this information, the WebTV server stores a one-time, scratchpad authentication and encryption key and the ANI information in a master database. This database controls all future access between that particular box and the WebTV servers.
Here is an example of the parametes on the scratchpad:
Once the TellyScript creation process has been completed, the box disconnects from the 800#. It then uses the TellyScript information to make a call to one of the local POP dialups. WTV has over 500 in the United States alone. Here, one is assigned a Client IP# and is connected to WebTV. The Tellyscript has provided the box with several local numbers where they are available and to roll over to a 800# number if the local numbers are busy. The intent is so customer is almost always connected.
If ever a box loses and later regains electrical power, it asks the user if it is connected to a different phone number. If the user answers, "Yes," the box repeats the TellyScript creation process, obtaining a new TellyScript and dialing the best POP number at the new location. This feature allows the user to easily move the box from one location to another. WebTV servers also automatically download new TellyScripts that reflect additions and changes in access numbers. Unlike a computer user who must update dial-in configuration information for each such change, the user doesn't even need to know when changes occur.
Once the WebTV Internet terminal has its TellyScript and dials-in locally to WebTV's service, it connects to a process called "headwaiter." This process knows the locations of all the other WTV services the terminal needs to deliver to the customer. It picks a set of servers for all the various WTV services (see Client:ShowServices IP List) These servers are assigned for use by the terminal during a single session. If this is the customer's first connection, a registration service is invoked to create a user name and password and to acquire billing information. The registration server stores this information in the master database and creates a directory on a file server to store the user's e-mail, favorite Web sites, and other user-specific information. All of this happens behind the scenes with minimal delay and frustration to the user.
Group: alt.discuss.webtv.technical Date: Sat, Jun 12, 1999 From: ulTRAX@webtv.net (///\ ulTRÅX \\\/) Re: Old project: Login Sequence #5 This is the 5th version of a rough sketch... Somewhere in ROM must be the startup codes that download the modem software off the HD. That modem code can be found at: http://members.tripod.com/ulTRICK/modem.txt Fortunately the modem code is written in plain enough English so even a PC phobic like myself can get a vague idea what's going on... though I'm sure I made a mess in what I deleted from that code trying to strip it down to some essential actions. There does not seem to be one straight forward sequence but contingincies should XY&Z not go acording to plan. This code is curious in that it seems to have both sides of the action going on.... the commands and the responses. That is something we don't have a clear idea about with the browser..... (actually that's not entire true.... oftern the server's response is the HTML code we see as a page.). TellyScript: Rockwell modem downloader 1.6 =Igetfilesystemdata file://rom/Data/modem_loader.dat data =Igetfilesystemdata file://rom/Data/null_loader.dat TellyScript: couldn't get address of modem loader TellyScript: sending download request TellyScript: downloading sram loader TellyScript: downloading NULL loader TellyScript: error downloading sram Download Modem Firmware .. TellyScript: downloading modem firmware =Igetfilesystemdata file://rom/Data/modem_firmware.dat TellyScript: couldn't get address of modem firmware TellyScript: error downloading modem firmware Modem Firmware Successfully Loaded TellyScript: download complete TellyScript: total time to download = %d seconds =S OK =SNO CARRIER =SNO DIALTONE =SBUSY =SNO ANSWER =SConnected! TellyScript: ParseResult -- %d unknown TellyScript: Configured modem. TellyScript: TIMEOUT waiting for OK Ibuiltin_winkdtr =Igetphonesettings c*IaccessNumber =@Isettings c*IdialOutsidePrefix =@Isettings c*IdialLDPrefix =@Isettings c*IcallWaitingPrefix =@Isettings cIusePulseDialing =Isettings cIaudibleDialing =Isettings cIdisableCallWaiting =Isettings cIdialOutsideLine =Isettings cIchangedCity =Isettings cIwaitForTone =Isettings cIhasCallWaiting =Isettings cIuseCallWaitingHack =Isettings cIdialSpeed =Isettings cIbrokenPBX =Isettings cInumberToDial cIsecondConfigCommand cIdialCommand c*IconfigurationCommand =SATS38=0S30=180S95=36S11=60&D2V1E0L3&Q5&K3 [[[[[vendatelly modem code LOL]]]]] defaultNumber =18006138199 =Igetpreregnumber =Igetsecret =Igetserialnumber username password TellyScript: 800 Registration Script 4.0 TellyScript: Over-riding default preregistration number with %s from NVRAM ,InvOverRide i(IaccessNumber TellyScript: TCP Window Size set to 3 TellyScript: Couldn't get OK from modem during first config cmd Isetdtr Iflush TellyScript: Couldn't get OK from modem during second config cmd Isetdtr Dialing toll free TellyScript: Overriding exclusion circuit... TellyScript: Dialing %s... ,InumberToDial TellyScript: TIMEOUT waiting for dial Waiting for answer TellyScript: got '%s' at odd time WebTV answered TellyScript: dterate = %d, dcerate = %d, protocol = %d, compression = %d Idterate Starting communication TellyScript: Using '%s' for username TellyScript: Using '%s' for password Isetusername Isetpassword TellyScript: PAP authentification failure TellyScript: PPP negotiation failed Connected to WebTV TellyScript: Link connected. TellyScript: total time = %d (seconds) TellyScript: Configured modem. TellyScript: TIMEOUT waiting for OK Ibuiltin_winkdtr There must also be verification of the SSID... along with the subscriber ID#. The following also seem to be involved in the login sequence: cache:wtv-challenge-response cache:network-status cache:wtv-ticket wtv-session-key1 wtv-session-key2 wtv-user-connection-id wtv-user-session-id wtv-MD5-digest wtv-head-waiter:/login wtv-head-waiter:/login=true At that point we arrive at the familiar login screen: the main user menu. That URL has been known for over a year: wtv-head-waiter:/login-stage-two. If we click on any user name we use the following code.. the code that was used to hack accounts last spring (though that was done going into DEMO): wtv-head-waiter:/ValidateLoginName&user-id=XXXXXXX&target-url=dummy The "dummy" code changes with each login seems to have something to do with ads seen on the Home Page. If there is a PW on the account thePW Screen URL is: wtv-head-waiter:/ValidateLoginName&user-id=XXXXXXX&target-url=switching-user=true (I did get a small section of the PW code "&password=XXXX&user-ID=XXXXXXX". Where it goes, who knows. It might be a code from a server.) At this point we go to the Black Logo Splash screen. Here all we are aware of is a long wait... but I suspect that wait is no longer than the time necessary to download certain data and to send the server some requests for Setup info. It's also been reported that if WNI was unable to download your TV logs the night before, it will do so at this time. One command is which must be used at this time is: wtv-setup:/get-from-server=1&setup-advanced-option=1&setup-play-bgm=0&setup-bgm-tempo=&setup-bgm-volume=100&setup-background-color=c6c6c6&setup-font-size=medium&setup-in-stereo=1&setup-keyboard=alphabetical&setup-link-color=2222bb&setup-play-songs=1&setup-play-sounds=1&setup-text-color=0&setup-visited-color=8822bb&setup-japan-keyboard=roman&setup-japan-softkeyboard=norm&setup- (Incomplete code sequence.) Another command is: wtv-head-waiter:/login?DataDownload=1 which is probably part of login sequence for loading of ShowServices IP list. That code is usually found with the following code: wtv-disk/download-list. Often associated with these last two commands is: wtv-head-waiter:/login?DataDownload=190 and: cache:authorization-list Once there was an older code which may or may not stll be used: wtv-head-waiter:/check-tellyscript?next-url=wtv-home:/home&dummy=XXXXX Other commands that seem to be involved in login or relogin are: cache:wtv-head-waiter:/login-stage-two?relogin=true cache:wtv-head-waiter:/login-stage-two?relogin=UserName (?) wtv-head-waiter:/ReconnectTo (add URL?) wtv-head-waiter:/ReconnectToCache:URL (add URL?)