Using Wireshark and MITM to explore a STB

I’ve recently bought a new Freeview HD box from 3view. It has a whole host of features and can be considered a “connected” device. As with most high-end set-top-boxes (STB) it pulls software firmware updates from the web, and I was interested to see where it went to get these updates & how it knew they were available.

I know about using tools to sniff network traffic, but have only done this to sniff traffic coming directly out of the PC I’m running the capture software on. Buying this 3view box gave me more of an inventive to expand my knowledge & figure out how to capture the traffic from other devices.

It was actually relatively easy. I decided to do a Machine in the Middle (MITM) ‘attack’ which was documented over at the Wireshark wiki.

In my case I didn’t have 2 network cards, but did have a laptop with one network card, and a wireless card. In Windows XP I bridged the NIC to the Wireless adapter, then plugged in a cross-over cable that linked the 3view box to my laptop. Then, after a bit of messing about with IP addresses it started working.. my 3view box was accessing my wireless router via my laptop.

Now that all the traffic from the 3view box was going via my laptop, all I then needed to do was fire up Wireshark & take a look at the packets.

Intercepting the traffic allowed me to see where the box was going for it’s updates, and the User Agent. That’s been documented over at the 3viewer community website I set up for 3view owners.

http://3viewer.elementfx.com/

QR Code Bookmarklet

QR Codes are a useful way of getting data to your mobile phone using it’s built-in camera. They’re basically 2D barcodes that can carry things like URLs and contact details. On Android I’d recommend using the app called Barcode Scanner to read QR Codes.

There were instances where I wanted to open up a webpage with a long URL on my phone & didn’t want to go through the hassle of copying and pasting it into one of those online QR Code generators.

This bookmarklet for Firefox and newer versions of IE lets you create a QR Code for the page you’re on.. it’ll default to the current page, but you can also override this with something else (like a URL from your clipboard, or whatever).

Add a new bookmark to your toolbar, and set the URL to the code below (I’d have put the proper link on here but WordPress disables the Javascript);

javascript:var%20sCode=prompt('Enter%20URL%20to%20encode',window.location);void(window.open('http://chart.apis.google.com/chart?cht=qr&chs=300x300&chl='+encodeURIComponent(sCode),'Qr%20code','top=100,left=200,width=350,height=350,status=yes'));

iPhone and Android development with Titanium

Over the past few months I’ve worked on a couple of mobile applications for the iPhone and Android platforms. I’d looked at Phonegap some time before that, but determined that it wasn’t up to the job, but more recently I stumbled across Titanium from Appcelerator. The idea is that you code up your apps using HTML and Javascript. The Javascript calls the Titanium API to create things like lists, dialog boxes, and phone features such as geolocation.

Some of the advantages of using Titanium are:

- No need to learn Objective-C (iPhone) or Java (Android)
- Leverage existing HTML + Javascript skills
- Write one version of the code that can be deployed to both platforms
- Code is compiled up into native applications which are accepted in the App Store
- Potential to deploy to other platforms in the future (e.g. Blackberry, Symbian)

The level of support provided by the Appcelerator staff on the official forums is brilliant, and the tutorial videos are good for those who want to get an overview of creating apps without wading through documentation.

You’ll still need a Mac if you want to develop for the iPhone, because Titanium makes use of the iPhone SDK. But if you just want to do Android development then you can use Window or Linux as well.

Although you’ll be developing 1 set of code for both the iPhone and Android, you’ll probably want to customise the UI slightly differently for each platform. For example, Android apps often hide away items such as ‘Settings’ and ‘Help’ under the Menu button. It’s simple to code this kind of thing up:

	if (Titanium.Platform.name == 'android') {
		var menu = Titanium.UI.createMenu();
		menu.addItem("Help/About", function() {
			displayWindow('Help / About', 'window_about.html');
		}, Titanium.UI.Android.SystemIcon.HELP);
		Titanium.UI.setMenu(menu);
	} else {
		data.push({title:'Help / About',image:'tabicon_help.png', color:'#ffffff'});
	}

That code will create the Help/About option under a menu on Android, and add it to the home screen’s list on the iPhone. Simple.

Titanium is an awesome framework so if you’re considering developing for the iPhone and/or Android then I’d highly recommend you take a look.

Power Meter Plus in PC Pro Magazine

Power Meter Plus has been getting a lot of coverage this month; it’s been mentioned on dozens of blogs and now in PC Pro magazine issue 172, in fact I think Lifehacker might have picked up on it from there & the blogs picked up on Lifehacker’s article.

Power Meter Plus featured on Lifehacker

Lifehacker is one of my daily visits, so it was brilliant to see that it had Power Meter Plus as the Featured Windows Download :-D

Creating a Netvibes / iGoogle Gadget for Multi-Image Display

To help make it as easy as possible for family members to see new pictures from the Collinge household I decided to set them up with Netvibes homepages, each containing a widget to display the latest photos from Picasa Web Albums. Picasa Web Albums provide an RSS feed that you can subscribe to which is a good start.. but I couldn’t find a way to display them just as I wanted.

The spec is to display the latest images, over as many columns as the user specifies.. and have the images resize to fit the width of the widget. They pretty much get displayed in a grid style layout.

Step 1) Get the URL for Picasa Web Albums (or whatever service you’re using) and make sure it works. The first gotcha here was that Picasa Web Albums has a limitation which means that images > 800px will not be embedded. They’ll result in a 404 File Not Found. To get around this, append ?imgmax=800 to the RSS’s URL.

Step 2) The feed for Picasa Web Albums is sorted in ascending date order.. I wanted it in descending date order so that the latest photos show first. To do this I chose to re-format the feed using Yahoo Pipes.. it’s a way of tinkering with a feed an invaluable for times when you need to do something simple like this.

Picasa gives you an Atom-based feed which seems to be causing a few issues with my code.. it basically makes the images go into a different node from the one I expected.. and I’ve been unable to work out exactly where it’s putting them. The best way around this is to simply run the RSS feed through a simple Yahoo Pipe; I’ve published one which sorts the images in date descending order. Use that and copy the RSS feed it generates.

Step 3) Create a new widget using UWA so that it works with Netvibes and iGoogle. This is relatively simple.. just requiring a bit of coding to make it happen. As usual I’ve tried to make the code as generic as possible & driven by user preferences. The user can specify which node in the JSON object (returned from the RSS feed) contains the image to display.. useful when dealing with non-standard image enclosures. It will default to the first enclosure at item.enclosures[0].url

The finished widget is published here.

<?xml version="1.0" encoding="utf-8"?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xmlns:widget="http://www.netvibes.com/ns/"  >
	<head>
		<title>Multi-Image Display</title>
		
		<meta name="author" content="Matt Collinge" />
		<meta name="email" content="do-not-email@mt2009.com" />
		<meta name="description" content="Display multiple images from an RSS feed. Useful for feeds like those from Picasa Web Albums" />
		<meta name="version" content="1.0" />
		<meta name="website" content="http://eco.netvibes.com/widgets/298784/multi-image-display" />

		<meta name="keywords" content="image, rss, picasa, web album, picture, multiple, display, grid" />
		<meta name="autoRefresh" content="15" />
		<meta name="apiVersion" content="1.2" />
		
		<link rel="stylesheet" type="text/css" href="http://www.netvibes.com/themes/uwa/style.css" />
		<script type="text/javascript" src="http://www.netvibes.com/js/UWA/load.js.php?env=Standalone"></script>
		
		<style type="text/css">
			.imageDisplay {
				margin:0;
				padding:0;
			}
		</style>
		
		<widget:preferences>
			<preference name="title" type="text" label="Title" defaultValue="Multi-Image Display" />

			<preference name="url" type="text" label="RSS Feed" defaultValue="" />
			<preference name="limit" type="range" label="Number of images to display" defaultValue="10" step="1" min="1" max="50" />
			<preference name="columns" type="range" label="Number of columns to use" defaultValue="2" step="1" min="1" max="8" />
			<preference name="imagenode" type="text" label="Node in RSS Feed Containing Image" defaultValue="item.enclosures[0].url" />
		</widget:preferences>
	
		<script>
			var BasicRSSReader = {};
			 
			BasicRSSReader.feed = false;
			 
			widget.onLoad = function() {
				if (widget.getValue('url') === '' || widget.getValue('url') == undefined) {
					widget.setBody('Please edit the preferences and enter the URL of the RSS feed where you want to take images from.<br><br>. Use a feed re-formatter like Yahoo Pipes if you need to tinker with a 3rd party RSS feed.');
				} else {
					widget.body.addClassName('imageDisplay');
					widget.setTitle(widget.getValue('title'));
					UWA.Data.getFeed(widget.getValue('url'), BasicRSSReader.display);
				}
			}
			
			BasicRSSReader.display = function(feed) {
				var bodyHTML = '';
				if (feed) BasicRSSReader.feed = feed;
				
				var imageWidth = widget.body.getDimensions().width / widget.getValue('columns');
				var imageCount = 0;
				var columnCount = 0;
				
				bodyHTML += '<table border=0 cellpadding=0 cellspacing=0>';
				for(var i=0; i < BasicRSSReader.feed.items.length; i++) {
					var item = BasicRSSReader.feed.items[i];
					
					if (imageCount >= widget.getValue('limit')) {
						bodyHTML += '</tr>';
						break;
					}
					
					if (columnCount == 0) {
						bodyHTML += '<tr>';
					}
					bodyHTML += '<td><a href="' + item.link + '"><img src="' + eval(widget.getValue('imagenode')) + '" width="' + imageWidth + '" /></a></td>';
					
					columnCount++;
					
					if (columnCount == widget.getValue('columns')) {
						columnCount = 0;
						bodyHTML += '</tr>';
					}
					
					imageCount++;
				}
				bodyHTML += '</table>';
				
				if (imageCount==0) bodyHTML = 'Unable to load feed.';
				widget.setBody(bodyHTML);
			}
		</script>			
	
	</head>
	<body>
		<p>Loading...</p>

	</body>
</html>

Netvibes UWA

Netvibes is a pretty awesome personal homepage web app. It’s very similar to iGoogle, but IMO it’s a lot more stable & a lot better looking. Netvibes offer a unified API that allows you to write using their API and deploy your gadget to multiple providers, such as iGoogle, Opera, iPhone, MacOSX and Vista.

I’ve been writing a gadget for my company but decided I also wanted one to take the first image out of an RSS feed and present so that it takes up all the space in the gadget. Useful for things like LOLcats. It was surprisingly simple to create.. so with some UWA coding, and a simple pipe at Yahoo Pipes, I’m now able to bring in the first image from a specified RSS feed.. assuming the image’s URL has been put into the item.content tag.

Here’s the finished gadget.. and the source code is below…

<?xml version="1.0" encoding="utf-8"?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xmlns:widget="http://www.netvibes.com/ns/"  >
	<head>
		<title>Single Image Display</title>
		
		<meta name="author" content="Matt Collinge" />
		<meta name="author_email" content="gadget@mattcollinge.co.uk" />
		<meta name="description" content="Display an image from the content section of the first item in an RSS feed. Useful for feeds like those from LOLCats. Use Yahoo Pipes to get the image URL (only) into the item.content tag." />
		<meta name="version" content="1.1" />
		<meta name="website" content="http://www.mattcollinge.co.uk/" />
		<meta name="keywords" content="image, rss, lolcats, single, full width" />
		<meta name="autoRefresh" content="15" />
		
		<link rel="stylesheet" type="text/css" href="http://www.netvibes.com/themes/uwa/style.css" />
		<script type="text/javascript" src="http://www.netvibes.com/js/UWA/load.js.php?env=Standalone"></script>
		
		<style type="text/css">
			.imageDisplay {
				margin:0;
				padding:0;
			}
		</style>
		
		<widget:preferences>
			<preference name="title" type="text" label="Title" defaultValue="Single Image Display" />
			<preference name="url" type="text" label="URL" defaultValue="" />
		</widget:preferences>
	
		<script>
			var BasicRSSReader = {};
			 
			BasicRSSReader.feed = false;
			 
			widget.onLoad = function() {
				if (widget.getValue('url') === '' || widget.getValue('url') == undefined) {
					widget.setBody('Please edit the preferences and enter the URL of the RSS feed where you want to take the image from.<br><br>The image URL must be in the item.content tag otherwise this will not work. Use feed a reformatter like Yahoo Pipes if you need to tinker with a 3rd party RSS feed such as LOLcats.');
				} else {
					widget.body.addClassName('imageDisplay');
					widget.setTitle(widget.getValue('title'));
					UWA.Data.getFeed(widget.getValue('url'), BasicRSSReader.display);
				}
			}
			
			BasicRSSReader.display = function(feed) {
				var feedList = 'Unable to load feed.';
				if (feed) BasicRSSReader.feed = feed;
				var item = BasicRSSReader.feed.items[0];
				feedList = '<img src="' + item.content + '" width="' + widget.body.getDimensions().width + '" />';
				widget.setBody(feedList);
			}
		</script>			
	
	</head>
	<body>
		<p>Loading...</p>
	</body>
</html>

Using JSLint with Notepad++

I’m doing a fair amount of development using the ExtJS framework. IE is a bit picky about getting JavaScript properly formatted (otherwise it refuses to render the page). That’s why I’ve found JSLint really useful for locating stray commas or semi-colons.

To make it a bit quicker to put the file contents in the JSLint box I decided to hook it up to the Run menu in Notepad++. However, the JSLint web page doesn’t allow us to pass in data to it. To get around this you can copy the HTML + JS files from the authors website an copy them locally. Once you’ve got them locally you can modify the source to allow the passing of data.. here’s the change I made to do it on my system:

jslint.php changes.. add this right near the end

<script src="javascript.js"></script>

You’ll then need a way to take the file contents and fire it off to the page. At first I tried passing the file contents via the GET request, but it’s limited in length. Also, Notepad++ won’t let you send the file contents via the Run command. In the end I chose to use a piece of VBScript to bring up the webpage in the default browser, and some JavaScript to read in the file & place it into the page.

launchJSLint.vbs

Set objFSO = CreateObject("Scripting.FileSystemObject")
Set objFile = objFSO.OpenTextFile(wscript.Arguments(0), 1)

Dim strCharacters

Do Until objFile.AtEndOfStream
    strCharacters = strCharacters + objFile.Read(1)
Loop

strCharacters = Escape(strCharacters)

Set objFileSystem = CreateObject("Scripting.fileSystemObject")
Set objOutputFile = objFileSystem.CreateTextFile("c:\progra~1\notepad++\jslint\javascript.js", TRUE)
objOutputFile.WriteLine("document.getElementById(""input"").value = unescape(""" & strCharacters & """);")

Dim wShell
Set wShell = CreateObject("WScript.Shell")
wShell.Run "c:\progra~1\notepad++\jslint\jslint.html", 9

Finally, this is the Run command you can use in Notepad++ to launch the script…

wscript "C:\Program Files\Notepad++\launchJSLint.vbs" "$(FULL_CURRENT_PATH)"

Switching FoxyProxy Profiles using Script

FoxyProxy is a useful extension to Firefox, but I’m always having to switch profiles back and forth as I take my laptop from work to home, and vice versa. I experimented with proxy PAC files without any success (mainly because laptops have multiple network adapters and the PAC scripts only detect your first IP address). Plus, as far as I can tell, PAC files are checked for every single HTTP request which must be a hit on browser performance.

Anyway, what I decided to do was directly modify the FoxyProxy config file before Firefox was run, and this would then select which FoxyProxy profile was used. The script below detects the host of something on my local network (which doesn’t exist at work) and switches accordingly. You could get it to switch on anything you like, but this works for me.

runfirefox.vbs

Set WshShell = WScript.CreateObject("WScript.Shell")

' Code to determine where you are and switch profiles accordingly
if (Ping("somehost") = "201.69.34.132") then
	ModifyFoxyProxy("3402440320")
else 
	ModifyFoxyProxy("patterns")
end if

' Run Firefox - this uses a specific profile.. your command line can simply exclude it
ReturnCode  = WshShell.Run("""C:\Program Files\Mozilla Firefox\firefox.exe"" -profile ""z:/firefox/profiles/qtxjee58.default""", 6, False)



sub ModifyFoxyProxy(sProfile) 
	' Path to your foxyproxy.xml file
	xmlfile="Z:\Firefox\Profiles\qtxjee58.default\foxyproxy.xml"
	outfile="Z:\Firefox\Profiles\qtxjee58.default\foxyproxy.xml"
	set oparser=createobject("msxml2.domdocument")
	with oparser
	    .async=false
	    .validateOnParse=false
	    .resolveExternals=false
	    .load xmlfile
	end with
	    
	if oparser.parseerror.errorcode<>0 then
	    wscript.echo "xml file " & xmlfile & " is not well-formed." & vbcrlf & "Operation aborted."
	    wscript.quit 999
	end if
	
	set oroot=oparser.documentElement
	oroot.setAttribute "mode", sProfile
	oparser.save outfile
	    
	set oparser=nothing 

end sub


function Ping(strHost)

    dim objPing, objRetStatus

    set objPing = GetObject("winmgmts:{impersonationLevel=impersonate}").ExecQuery ("select * from Win32_PingStatus where address = '" & strHost & "'")

    for each objRetStatus in objPing
        if IsNull(objRetStatus.StatusCode) or objRetStatus.StatusCode<>0 then
    		Ping = ""
            'WScript.Echo "Status code is " & objRetStatus.StatusCode
        else
            'Ping = True
            'Wscript.Echo "Bytes = " & vbTab & objRetStatus.BufferSize
            'Wscript.Echo "Time (ms) = " & vbTab & objRetStatus.ResponseTime
            'Wscript.Echo "TTL (s) = " & vbTab & objRetStatus.ResponseTimeToLive
            Ping = objRetStatus.ProtocolAddress 
        end if
    next
    
end function 

USB Detect & Launch Version 1.5 Released

USB Detect & Launch allows you to automatically execute a script or application each time a USB storage device is plugged into your PC. Different scripts can be executed for different devices and it’s the volume label that determines what action to perform.

Version 1.5 contains new functionality to monitor for any device being plugged in; useful when you have no control over what memory stick is being inserted, but need to fire off a script to perform a particular action.

e.g.

label:(any)
exec:”c:batchbatch-any.cmd” %1 %2

You can find the download on the USB Detect & Launch page.

Drive Map Pro 1.6 Released

Drive Map Pro is a great piece of Windows software for organising all the servers you connect to. It’s primary purpose is to give you easy access to mapping a network drive with the minimum of fuss, however it does a lot more that that, including managing your VNC/Radmin connections too!

The latest version of Drive Map Pro (version 1.6) is now available to registered users and includes the following:

• Lots of bug-fixes :-D
• Ability to have multiple UNC drive mappings under one entry, syntax is ‘\serverc$,d$,whatever’, which gives you the ability to map to any/all 3 of those drives without clogging up your list of servers!
• Middle-click launches the application you’ve associated with the server.. saves a click or two!
• Store notes against each entry.. handy for storing box info, like who’s the administrator
• More application preferences (like auto-hide DriveMapPRO after launching an application)

Click here for more information on Drive Map Pro.

Mapping a drive has never been easier!!

Topfield TF5800 – a hacker’s PVR :)

The Netgem iPlayer I’ve had for watching Freeview doesn’t provide any PVR functionality, so I’ve been looking for a replacement that does everything I want. It was between the Humax 9600 and the Topfield TF5800. After a lot of research I went for the Topfield.

The thing that swung it for is that the Toppy is extremely configurable due to 1) the custom firmwares 2) the user-built applications (TAPs) that are available.

Between the firmwares and the TAPs you can customise almost anything! For example, on the standard box the display on the front will show the time when in standby, and the channel number when it’s switched on. That’s not something I care for.. I can see the channel I’m watching and the time is more useful to me. Someone else obviously thought the same, and they’ve created a TAP (TF5000Display) to completely customise the display to your needs, doing way more than what I needed.

First Things First

Setting the box up wasn’t as arduous as I thought it was going to be. After rigging it up to the TV and making sure everything worked, I fired up my laptop and installed the Topfield Tools suite, together with the USB Driver for Windows XP. Easy so far.

Firmware

Next I downloaded the firmware I wanted to install. This was from Toppy.org.uk and required me to sign up for their forums, and that gave me a login for the main site that brings up a new menu where you can download new (and beta) firmwares. I chose the 5.13.65 release which was recommended by the site.

The firmware can then be (optionally) patched with extra fixes which have been community-written. To work out which ones I wanted to integrate into the firmware I read this topic and downloaded FWPatcher & PatchPackV2 which contained everything I needed.

The patches I chose were:

• [C0] NoCYR
• [Cy] NotCYR_02
• [H] HDDPatch_03
• [I] PBSiS
• [P] PowerRestore_05
• [R] RecRoundel
• [S] StartupPatch_03
• [T2] TimerPatchT2b
• [Ts] TimerSetting_02
• [T] TimerPatch_04b
• [Wf] WindFaster_02
• [Xp] PlayNoCYR_04
• [Xw] WatchNoCYR_03
• [Z] Disable0AspectSwitching

After integrating the patches the next step was to blow it onto the Toppy using the firmware utility in Topfield Tools.

The process was surprisingly easy and the online documentation is good if you get lost.

TAPs

There’s only so much you can stuff into 1.5mb of firmware, and Topfield were considerate enough to allow people to program applications, a bit like plug-ins, which have access to an API provided by the company. That allows these programs to access things like EPG data or write out to the screen.

The standard EPG that ships with the box isn’t great.. but add the MyStuff TAP and the unit is completely transformed with a highly customisable, and skinnable EPG. There’s even a 71-page PDF manual for MyStuff! Here are 3 things you can customise (out of a list of maybe a hundred):

• Show/hide channel logos
• Choose how many hours to display in the EPG window (3hrs seems sensible)
• How many channels to display per EPG page (8 suits me!)

The TAPs I added on day 1 were:

• MyStuff (which adds a few of it’s own, including one that scrapes EPG data)
• Display
• PowerDown
• TAPCommander

Conclusion

The standard Topfield box is okay. And it’ll probably be a lot better with the new firmware that will be released shortly that features in the new TF5810 and conforms to the Freeplay standard. However, with the custom firmware and TAPs (especially MyStuff) the box is awesome and I’m having a great time configuring it to be exactly what I want from a Freeview PVR box. Kudos to the user-community who put so much time into developing the patches and TAPs!! And thanks to Topfield for being forward-thinking enough to open it up enough to allow these mods to be written.. if only more manufacturers did this!!!

Quick Video Demo

This is a demo showing what the Topfield PVR looks like once the MyStuff application has replaced the standard UI.

At the start of the video you’ll see the default Toppy UI, then I fire up MyStuff where you’ll see the difference straight away.

After viewing the EPG I navigate around a bit, then show a MyStuff settings page to give you an idea of how many things you can configure.

I go on to show a few more things including setting series link (via a Search), and a some of the standard Topfield things like pausing live TV, PiP, etc.

Near the end I dip into TAPCommander which helps you configure any user-written apps you’ve got loaded into memory.

This covers only a small portion of what the box is capable of and is only meant as a taster :)

File Mover 1.8 Released

New features in this release are:

• Force “first-in, first-out” queueing of files.. files will be processed in date order (oldest first).
• Wait for executed script to finish before processing the next file (useful when FIFO queue is being used, or when your script is so intensive you don’t want >1 process running)

Click over to the software page for the download.

XBMC Script – Caller Id 1.3 Released

This script for XBMC allows you to display details of incoming calls. Full details on how to get this up and running are on this page; you’ll need the right kind of modem attached to a PC running software like YAC.

The latest versions of the Caller Id script now include:

• Play a sound when a call is displayed (optional)
• Support for Switchboard by James Traynor merged into this release
• Small bugfixes around which name to display
• Better logging so it’s easier to debug when things go wrong :)
• Pause playback option (optional)
• When YAC has passed a name, display that rather than the number
• Display an initialisation message when script starts (optional)
• Code to allow this to run in Python emulator on a PC

You can find the script at XBMCScripts.com.

USB Detect & Launch Version 1.4 Released

This new version includes the ability to detect when devices with no label are inserted. This is handy when you have a whole stack of new devices that you need to put data onto.

Here’s an example of the syntax you’d use:

label:(no label)
exec:”c:\batch\batch-no-label.cmd” %1 %2

Click over to the software page for the download.