1. This site uses cookies. By continuing to use this site, you are agreeing to our use of cookies. Learn More.

Using HR21 for other purposes...?

Discussion in 'DIRECTV Tips and Resources' started by fire219, Aug 5, 2014.

  1. fire219

    fire219 New Member

    Aug 4, 2014
    Armpit of Hell
    Before I get started......

    First of all, I am new around here, so I may have put this in the wrong place (though this seems like the best spot, since there is more technical talk in here than the other sections). It may not even be welcome here on DBSTalk at all, due to the potentially sensitive subject at hand. I am not attempting to decrypt the transmissions/recordings from DirecTV, simply reuse this hardware. If you do choose to participate, I am not responsible if you incur the full wraith of DirecTV upon yourself.

    Now let's get started. :)

    A few months ago, one of our HD DVRs (HR21-700) started to act up (intermittently lock up and refuse to boot). It has been replaced by one of it's -100 brethren. However, DirecTV has not asked for this old box back (nor the access card, for that matter...), and has not incurred a non-return fee. I presume they have decided these machines are too old to continue reusing, and do not want them back. This means I have a rather capable computerized system to play with.

    My end mission here is to get a new operating system on this box. I decided start my quest by dissecting the contents of the hard drive inside. Maybe it will give clues into the inner workings of this secretive box.

    Reading contents of the HDD: (This happened a few months ago, so technical details may not be 100% accurate, until I gain the motivation to try this again)

    After booting my computer into Ubuntu (I correctly doubted that the hard drive would be in NTFS or FAT32!), and several hours of trial, error, and profanity, I found that the hard drive has three partitions: the main XFS filesystem, a realtime (journaling) section, and swap space.

    The swap space seems like it would be the easiest to pick apart, so I started there. I dumped it to a file (which I would share, but it was several hundred MB, and I seem to have lost it! :( ), and started reading. Right off the bat, I found boot logs, debug lines that confirmed that the HR2x boxes run Linux, RSA keys (no idea if it's the public or private one) and most interestingly, Java stacktraces! This gave me a lot of interesting info, but didn't help too much. Time to dive into the XFS filesystem.

    After more hours of the above three stages, I finally got the XFS system mounted and readable. This is what greeted me.

    (click for full screen)

    Oooh, I see Linux root folders (lib and etc)!
    Unfortunately, they don't contain much.
    (click for full screen)

    Well, lets look at the other stuff... ooooh more java logs... can't find the actual jar files though :/

    (Continue exploring and not finding much. I did find the recording files, but I'm not going to cover that. I'm already likely on thin ice legally... I eventually get bored, and give up project for a few months.)
    ...2 months later...
    Yea, lets see if I can get further this time!
    Squashfs images! Maybe I can find something in these!

    Or maybe not, after two hours of working, I can only get linux utilities to recognize them as LZMA1-compressed squashfs images. Nothing will mount them or extract them. Not even let me see the file tree inside.
    to be continued.

    So... what now?

    Has anyone else experimented like this? If so, what have you found?

    One of my current projects on this is to try to find a working serial port on the main board. So far, that has failed as well.

    If someone thinks they could help, but don't have a sacrificial HD DVR, I could also send some of the files (such as squashfs images).

    Thanks for reading. :)
  2. litzdog911

    litzdog911 Well-Known Member

    Jun 23, 2004
    Mill Creek, WA
    Interesting stuff. Keep probing. So far, I've seen no reports where anyone has successfully done much of anything with a DVR hard drive or its contents.
  3. fire219

    fire219 New Member

    Aug 4, 2014
    Armpit of Hell
    Thanks. :)

    I've gotten file trees to output off one of the squashfs files. They do indeed contain interesting stuff. Still no extraction yet. Will update again soon.



    Too lazy to make a thumbnail this time, so here's a link.

    Got it extracted. :)

    Time to explore.
  4. fire219

    fire219 New Member

    Aug 4, 2014
    Armpit of Hell
    Alright, new chapter here. Going to be a bit more informational and less story-tell-y.

    The squashfs files.

    These files are stored in the XFS partition, at /network/plugins.

    The files are organized by three statistics: asset ID, asset version, and minimum stack version.

    ID table:

    7 - aac_mp4 (libraries and binaries for AAC, MP4, and "drmmanager")
    13 - youtube (libs/bins for Youtube)
    17 - AdInsertion (no idea, has bin "plgwrapper" and lib "libdtvport.so")
    19 - itvwebkit (I assume it is for rendering of web content...)
    21 - pgwsclient (some sort of administration tool(s)? contains stuff for cURL and lots of bash scripts...)
    23 - hd_assets (all of the UI and sound elements)

    Therefore, 7_2129_2129.squashfs is version 2129 of the libraries for AAC and MP4 files.

    Also in the /network/plugins directory, is the signature files for the squashfs files.

    For example, the sig file for 23_139_2100 is:

    And here is the image for the screensaver. :)


Share This Page