Reverse Engineering the Tivo Stream: TiVo App

I have the decrypted application code in a disassembler, now I need to know what keywords to look for in order to know where to start my search. In order to do this I decided to look at the iPod Touch logs to see if the TiVo outputs any logging...

Viewing the iOS logs

I found a neat tool from Apple called "IPhone Configuration Utility" that has the ability to view logs on your PC when the iOS device is plugged in. It is available here: http://support.apple.com/kb/dl1466

I fired up the application and let it "Search for TiVo's" and watched the log...

Mar 30 20:46:13 XXXXXXXX-iPod kernel[0] <Debug>: launchd[1286] Builtin profile: container (sandbox)

Mar 30 20:46:13 XXXXXXXX-iPod kernel[0] <Debug>: launchd[1286] Container: /private/var/mobile/Applications/A83E86A7-13BA-4450-912D-651D8672165D (sandbox)

Mar 30 20:46:13 XXXXXXXX-iPod Quicksilver[1286] <Notice>: MS:Notice: Installing: com.tivo.quicksilver [Quicksilver] (793.00)

Mar 30 20:46:13 XXXXXXXX-iPod Quicksilver[1286] <Notice>: MS:Notice: Loading: /Library/MobileSubstrate/DynamicLibraries/zzzzzzzz_xCon.dylib

Mar 30 20:46:14 XXXXXXXX-iPod Quicksilver[1286] <Warning>: MyShowsViewController: initWithCoder

Mar 30 20:46:14 XXXXXXXX-iPod Quicksilver[1286] <Warning>: reachabilityChanged: wanReach - ReachableViaWiFi (connection required:0)

Mar 30 20:46:14 XXXXXXXX-iPod Quicksilver[1286] <Warning>: reachabilityChanged: lanReach - ReachableViaWiFi (connection required:0)

Mar 30 20:46:15 XXXXXXXX-iPod Quicksilver[1286] <Warning>: SetupViewController: viewDidLoad

Mar 30 20:46:15 XXXXXXXX-iPod Quicksilver[1286] <Warning>: startScanningBonjourKeepalive

Mar 30 20:46:15 XXXXXXXX-iPod Quicksilver[1286] <Warning>: SetupViewController: viewWillAppear:(animated=NO)

Mar 30 20:46:15 XXXXXXXX-iPod Quicksilver[1286] <Warning>: organizeVideos: 0 completed titles, 0 pending videos

Mar 30 20:46:15 XXXXXXXX-iPod Quicksilver[1286] <Warning>: Not resuming any sideloads- suspended by user

Mar 30 20:46:16 XXXXXXXX-iPod Quicksilver[1286] <Warning>: organizeVideos: 0 completed titles, 0 pending videos

Mar 30 20:46:16 XXXXXXXX-iPod Quicksilver[1286] <Warning>: Not resuming any sideloads- suspended by user

Mar 30 20:46:16 XXXXXXXX-iPod Quicksilver[1286] <Warning>: suspendSideloading

Mar 30 20:46:16 XXXXXXXX-iPod Quicksilver[1286] <Warning>: applicationDidBecomeActive

Mar 30 20:46:16 XXXXXXXX-iPod Quicksilver[1286] <Warning>: startScanningHelper

Mar 30 20:46:16 XXXXXXXX-iPod Quicksilver[1286] <Warning>: startBrowsing

Mar 30 20:46:16 XXXXXXXX-iPod Quicksilver[1286] <Warning>: stopBrowsing

Mar 30 20:46:16 XXXXXXXX-iPod networkd_privileged[1287] <Notice>: MS:Notice: Installing: (null) [networkd_privileged] (793.00)

Mar 30 20:46:16 XXXXXXXX-iPod Quicksilver[1286] <Warning>: netmask is 255.255.0.0

Mar 30 20:46:16 XXXXXXXX-iPod Quicksilver[1286] <Warning>: IP SCANNER: Starting IP Address:10.0.0.145

Mar 30 20:46:16 XXXXXXXX-iPod Quicksilver[1286] <Warning>: IP SCANNER: Base IP Address:10.0.0.

Mar 30 20:46:16 XXXXXXXX-iPod backboardd[65] <Warning>: CoreAnimation: updates deferred for too long

Mar 30 20:46:17 XXXXXXXX-iPod backboardd[65] <Warning>: CoreAnimation: timed out fence 1554b

Mar 30 20:46:17 XXXXXXXX-iPod SpringBoard[133] <Warning>: CoreAnimation: failed to receive fence reply: 10004003

Mar 30 20:46:18 XXXXXXXX-iPod Quicksilver[1286] <Warning>: found service: Living Room of type: _tivo-mindrpc._tcp.

Mar 30 20:46:18 XXXXXXXX-iPod Quicksilver[1286] <Warning>: - tivo found: Living Room (_tivo-mindrpc._tcp.)

Mar 30 20:46:18 XXXXXXXX-iPod Quicksilver[1286] <Warning>: found service: Living Room of type: _tivo-videos._tcp.

Mar 30 20:46:18 XXXXXXXX-iPod Quicksilver[1286] <Warning>: found service: DVR-431E of type: _tivo-videos._tcp.

Mar 30 20:46:18 XXXXXXXX-iPod Quicksilver[1286] <Warning>: TcpConnectionOpenedForInput ip:10.0.0.113 port:443

Mar 30 20:46:18 XXXXXXXX-iPod Quicksilver[1286] <Warning>: found service: Living Room of type: _tivo-remote._tcp.

Mar 30 20:46:18 XXXXXXXX-iPod Quicksilver[1286] <Warning>: - tivo found: Living Room (_tivo-remote._tcp.)

Mar 30 20:46:18 XXXXXXXX-iPod Quicksilver[1286] <Warning>: TcpConnectionOpenedForInput ip:10.0.0.109 port:443

Mar 30 20:46:18 XXXXXXXX-iPod Quicksilver[1286] <Warning>: TcpConnectionOpenedForInput ip:10.0.0.141 port:443

Mar 30 20:46:18 XXXXXXXX-iPod Quicksilver[1286] <Warning>: found service: Living Room of type: _tivo-device._tcp.

Mar 30 20:46:18 XXXXXXXX-iPod Quicksilver[1286] <Warning>: found service: STR 808A of type: _tivo-xcode._tcp.

Mar 30 20:46:18 XXXXXXXX-iPod Quicksilver[1286] <Warning>: TcpConnectionOpenedForInput ip:10.0.0.122 port:443

Mar 30 20:46:18 XXXXXXXX-iPod Quicksilver[1286] <Warning>: TcpConnectionOpenedForInput ip:10.0.0.113 port:31339

Mar 30 20:46:18 XXXXXXXX-iPod Quicksilver[1286] <Warning>: scanningTimeout 2

Mar 30 20:46:18 XXXXXXXX-iPod Quicksilver[1286] <Warning>: netServiceDidResolveAddress(autoresolve) - tsn: {TIVO_GUID}

Mar 30 20:46:18 XXXXXXXX-iPod Quicksilver[1286] <Warning>: - tivo found: DVR-431E (_tivo-videos._tcp.)

Mar 30 20:46:18 XXXXXXXX-iPod Quicksilver[1286] <Warning>: SetupViewController - didFindTiVo: DVR-431E

Mar 30 20:46:18 XXXXXXXX-iPod Quicksilver[1286] <Warning>: FOUND ANOTHER TIVO: DVR-431E, tsn: {TIVO_GUID}

Mar 30 20:46:18 XXXXXXXX-iPod Quicksilver[1286] <Warning>: Scanning - preferred tivo: Living Room

Mar 30 20:46:18 XXXXXXXX-iPod Quicksilver[1286] <Warning>: netServiceDidResolveAddress(autoresolve) - tsn: {TIVO_GUID}

Mar 30 20:46:18 XXXXXXXX-iPod Quicksilver[1286] <Warning>: - tivo found: Living Room (_tivo-videos._tcp.)

Mar 30 20:46:18 XXXXXXXX-iPod Quicksilver[1286] <Warning>: SetupViewController - didFindTiVo: Living Room

Mar 30 20:46:18 XXXXXXXX-iPod Quicksilver[1286] <Warning>: FOUND ANOTHER TIVO: Living Room, tsn: {TIVO_GUID}

Mar 30 20:46:18 XXXXXXXX-iPod Quicksilver[1286] <Warning>: Scanning - preferred tivo: Living Room

Mar 30 20:46:18 XXXXXXXX-iPod Quicksilver[1286] <Warning>: netServiceDidResolveAddress(autoresolve) - tsn: {TIVO_GUID}

Mar 30 20:46:18 XXXXXXXX-iPod Quicksilver[1286] <Warning>: - tivo found: Living Room (_tivo-device._tcp.)

Mar 30 20:46:18 XXXXXXXX-iPod Quicksilver[1286] <Warning>: SetupViewController - didFindTiVo: Living Room

Mar 30 20:46:18 XXXXXXXX-iPod Quicksilver[1286] <Warning>: FOUND ANOTHER TIVO: Living Room, tsn: {TIVO_GUID}

Mar 30 20:46:18 XXXXXXXX-iPod Quicksilver[1286] <Warning>: Scanning - preferred tivo: Living Room

Mar 30 20:46:18 XXXXXXXX-iPod Quicksilver[1286] <Warning>: connectToTiVo:targetTiVo={name:"Living Room", resolved:YES, tsn:"{TIVO_GUID}", localTiVoService:"<NSNetService 0x1e954340> local. _tivo-device._tcp. Living Room"

Mar 30 20:46:18 XXXXXXXX-iPod Quicksilver[1286] <Warning>: nrcEnabled on target...

Mar 30 20:46:18 XXXXXXXX-iPod Quicksilver[1286] <Warning>: Got mediaAccessKey (="{MEDIA_ACCESS_KEY}") for tsn (="{TIVO_GUID}") from Settings.

Mar 30 20:46:18 XXXXXXXX-iPod Quicksilver[1286] <Warning>: trying to connect...

Mar 30 20:46:18 XXXXXXXX-iPod Quicksilver[1286] <Warning>: connecting

Mar 30 20:46:18 XXXXXXXX-iPod Quicksilver[1286] <Warning>: selectTiVo - searching rpcBrowser:1

Mar 30 20:46:18 XXXXXXXX-iPod Quicksilver[1286] <Warning>: selectTiVo - found mindRpc

Mar 30 20:46:18 XXXXXXXX-iPod Quicksilver[1286] <Warning>: netServiceDidResolveAddress(autoresolve) - tsn: {TIVO_GUID}

Mar 30 20:46:18 XXXXXXXX-iPod Quicksilver[1286] <Warning>: - tivo found: STR 808A (_tivo-xcode._tcp.)

Mar 30 20:46:18 XXXXXXXX-iPod Quicksilver[1286] <Warning>: Transcoder: -initWithLocalTiVoInfo: 10.0.0.109:49152

Mar 30 20:46:18 XXXXXXXX-iPod Quicksilver[1286] <Warning>: netServiceDidResolveAddress - tsn: {TIVO_GUID}

Mar 30 20:46:18 XXXXXXXX-iPod Quicksilver[1286] <Warning>: - tivo resolve completed (1) for Living Room (_tivo-mindrpc._tcp.)

Mar 30 20:46:18 XXXXXXXX-iPod Quicksilver[1286] <Warning>: RESOLVE COMPLETED: DVR-431E, {TIVO_GUID}

Mar 30 20:46:18 XXXXXXXX-iPod Quicksilver[1286] <Warning>: RESOLVE COMPLETED: Living Room, {TIVO_GUID}

Mar 30 20:46:18 XXXXXXXX-iPod Quicksilver[1286] <Warning>: FOUND ACTIVE TIVO

Mar 30 20:46:18 XXXXXXXX-iPod Quicksilver[1286] <Warning>: tivoResolvedWithResult:1 for Living Room (svc:_tivo-device._tcp.)

Mar 30 20:46:18 XXXXXXXX-iPod Quicksilver[1286] <Warning>: SetupViewController setupRpcForTivo

Mar 30 20:46:18 XXXXXXXX-iPod Quicksilver[1286] <Warning>: Rpc Setup with tsn {TIVO_GUID}

Mar 30 20:46:18 XXXXXXXX-iPod Quicksilver[1286] <Warning>: hostname = DVR-4F48.local. ====== Living Room

Mar 30 20:46:18 XXXXXXXX-iPod Quicksilver[1286] <Warning>: service hostname = DVR-4F48.local., name= Living Room, ipAddr = 10.0.0.113

Mar 30 20:46:18 XXXXXXXX-iPod Quicksilver[1286] <Warning>: RpcRequestHandler setHostWithHost - host: 10.0.0.113, port: 1413, SSLDesc: 7

Mar 30 20:46:18 XXXXXXXX-iPod securityd[1289] <Notice>: MS:Notice: Installing: (null) [securityd] (793.00)

Mar 30 20:46:19 XXXXXXXX-iPod Quicksilver[1286] <Error>: Mar 30 20:46:19 SecTrustEvaluate [root AnchorTrusted]

Mar 30 20:46:19 XXXXXXXX-iPod Quicksilver[1286] <Warning>: Got mediaAccessKey (="{MEDIA_ACCESS_KEY}") for tsn (="{TIVO_GUID}") from Settings.

Mar 30 20:46:19 XXXXXXXX-iPod Quicksilver[1286] <Warning>: stopBrowsing

Mar 30 20:46:19 XXXXXXXX-iPod Quicksilver[1286] <Warning>: NetworkManager - MAK bodyAuthenticate query reqId: 1

Mar 30 20:46:23 XXXXXXXX-iPod Quicksilver[1286] <Warning>: scanningTimeout 3

Mar 30 20:46:23 XXXXXXXX-iPod Quicksilver[1286] <Warning>: IP SCANNER: end scan

Mar 30 20:46:23 XXXXXXXX-iPod Quicksilver[1286] <Warning>: IPScanner:Cert Description:secure.sling.com

Mar 30 20:46:23 XXXXXXXX-iPod Quicksilver[1286] <Warning>: Removing 10.0.0.122

Mar 30 20:46:23 XXXXXXXX-iPod Quicksilver[1286] <Warning>: IPScanner:Cert Description:XXX-XXXX-XXXX-XXXX

Mar 30 20:46:23 XXXXXXXX-iPod Quicksilver[1286] <Warning>: IPScannerInfo(10.0.0.141)-tsn:{TIVO_GUID} hasVideos:1 hasRemote:0

Mar 30 20:46:23 XXXXXXXX-iPod Quicksilver[1286] <Warning>: IPScanner:Cert Description:{TIVO_GUID}

Mar 30 20:46:23 XXXXXXXX-iPod Quicksilver[1286] <Warning>: IPScannerInfo(10.0.0.109)-tsn:{TIVO_GUID} hasVideos:1 hasRemote:0

Mar 30 20:46:23 XXXXXXXX-iPod Quicksilver[1286] <Warning>: IPScanner:Cert Description:{TIVO_GUID}

Mar 30 20:46:23 XXXXXXXX-iPod Quicksilver[1286] <Warning>: IPScannerInfo(10.0.0.113)-tsn:{TIVO_GUID} hasVideos:1 hasRemote:1

Mar 30 20:46:23 XXXXXXXX-iPod Quicksilver[1286] <Warning>: NetworkManager:mergeScanResults

Mar 30 20:46:23 XXXXXXXX-iPod Quicksilver[1286] <Warning>: Could not find TSN {TIVO_GUID} in the list...adding

Mar 30 20:46:23 XXXXXXXX-iPod Quicksilver[1286] <Warning>: rpc:0x0 beacon:0x0

Mar 30 20:46:23 XXXXXXXX-iPod Quicksilver[1286] <Warning>: Could not find TSN {TIVO_GUID} in the list...adding

Mar 30 20:46:23 XXXXXXXX-iPod Quicksilver[1286] <Warning>: rpc:0x0 beacon:0x0

Mar 30 20:46:23 XXXXXXXX-iPod Quicksilver[1286] <Warning>: Scan timeout. 1 transcoders found

Mar 30 20:46:23 XXXXXXXX-iPod Quicksilver[1286] <Warning>: discoveryScanningTimeout

Mar 30 20:46:23 XXXXXXXX-iPod Quicksilver[1286] <Warning>: ignoring timeout - not in scanning phase

Mar 30 20:46:23 XXXXXXXX-iPod Quicksilver[1286] <Warning>: shutownBonjourAfterScan:0

Mar 30 20:46:23 XXXXXXXX-iPod Quicksilver[1286] <Warning>: Got mediaAccessKey (="{MEDIA_ACCESS_KEY}") for tsn (="{TIVO_GUID}") from Settings.

Mar 30 20:46:23 XXXXXXXX-iPod Quicksilver[1286] <Warning>: backgroundFetchTranscoderInfo: Starting fetches

Mar 30 20:46:24 XXXXXXXX-iPod Quicksilver[1286] <Warning>: config for http://10.0.0.109:49152/sysinfo/json/main-dyn:

{

MRVCertState = 2;

end = end;

fHasMRVCert = 1;

fRestarting = 0;

fanSpeed = 0;

idle = 0;

mac = "XX:XX:XX:XX:XX:XX";

mak = {MEDIA_ACCESS_KEY};

netAddr = "10.0.0.109";

opt540p = 1;

optAudioGainText = 3;

optBitrateOverrideEn = 0;

optBitrateText = 2240000;

optDebugLevelText = 30;

optEncryptedHLS = 1;

optForceSideloadMedium = 0;

optHLSRotateKeys = 1;

optHighProfile = 1;

optMultipleProfiles = 1;

optPowerManagementEn = 1;

optSecureHLS = 1;

optSecureHLSDev = 0;

optSideloadPremium = 0;

powerState = 1;

powerStateTime = 2998;

svcCallStatus = 7;

svcNextCall = 1364725784000;

svcStreamingState = 6;

svcStreamingStateExt = 6;

svcTcdCallStatus = {

svcStatusMajor = 0;

svcStatusMinor = 0;

svcStatusPercentage = 0;

};

swBuildDate = "Nov 20 2012-11:57:30";

swUpdatePercent = 0;

swUpdateStatus = 1;

swVer = "19.1.1-01-6";

sysTemp = 52;

sysTime = 1364701583000;

tsn = {TIVO_GUID};

version = 2;

}

Mar 30 20:46:24 XXXXXXXX-iPod Quicksilver[1286] <Warning>: config for http://10.0.0.109:49152/sysinfo/json/clients:

{

clients = (

{

cci = 0;

context = 3;

cp = 0;

curseg = 39;

ehls = 1;

h264Level = 41;

h264Profile = 3;

hres = 960;

ip = "10.0.0.145";

maxCci = 0;

recordingId = 10160;

securehls = 1;

serverTSN = {TIVO_GUID};

sessionId = "17B22126-E8AE-49F3-B99F-5A9460AE9B6B";

tLastReq = 1364698623000;

targetBitrate = 2240000;

type = "iPod 4th Gen (Stream, Best)";

vres = 540;

}

);

}

Mar 30 20:46:24 XXXXXXXX-iPod Quicksilver[1286] <Warning>: config for http://10.0.0.109:49152/sysinfo/json/svcinfo:

{

MAKState = 2;

MRVCertState = 2;

SecureHLSState = 2;

ServiceLevel = 67;

ServiceStreamingAllowed = 1;

fHasMAK = 1;

fHasMRVCert = 1;

fHasSecureHLSData = 1;

guidedSetupInProgress = 0;

httpsCertState = 2;

sg = "{TIVO_GUID}|{TIVO_GUID}|{TIVO_GUID}";

svcLastCallStatus = 7;

svcNextCall = 1364725784000;

svcStreamingClients = {

Max = 50;

Num = 1;

};

svcStreamingState = 6;

svcStreamingStateExt = 6;

svcTcdCallStatus = {

svcStatusMajor = 10;

svcStatusMinor = 1;

svcStatusPercentage = 0;

};

version = 2;

}

Mar 30 20:46:24 XXXXXXXX-iPod Quicksilver[1286] <Warning>: Found sharing group TSNs (JSON query):

(

{TIVO_GUID},

{TIVO_GUID},

{TIVO_GUID}

)

Mar 30 20:46:24 XXXXXXXX-iPod Quicksilver[1286] <Error>: Mar 30 20:46:24 SecTrustEvaluate [root AnchorTrusted]

Mar 30 20:46:24 XXXXXXXX-iPod Quicksilver[1286] <Warning>: Got mediaAccessKey (="{MEDIA_ACCESS_KEY}") for tsn (="{TIVO_GUID}") from Settings.

Mar 30 20:46:24 XXXXXXXX-iPod Quicksilver[1286] <Warning>: backgroundFetchTranscoderInfo done for {TIVO_GUID}!

Mar 30 20:46:24 XXXXXXXX-iPod Quicksilver[1286] <Warning>: Transcoder hasTSNInSharingGroup returning YES [tsn = {TIVO_GUID}, tsnsInSharingGroup = (

{TIVO_GUID},

{TIVO_GUID},

{TIVO_GUID}

)]

Mar 30 20:46:24 XXXXXXXX-iPod Quicksilver[1286] <Warning>: PlayerProxy: Found a candidate for best transcoder!

Mar 30 20:46:24 XXXXXXXX-iPod Quicksilver[1286] <Warning>: Setting last transcoder TSN: {TIVO_GUID} Name: STR 808A

Mar 30 20:46:24 XXXXXXXX-iPod Quicksilver[1286] <Warning>: Not resuming any sideloads- we're suspended

Mar 30 20:46:24 XXXXXXXX-iPod Quicksilver[1286] <Warning>: MAK auth response: Authentication successful, status: 2

Mar 30 20:46:24 XXXXXXXX-iPod Quicksilver[1286] <Warning>: SetupViewController - optStatusGet query reqId: 2

Mar 30 20:46:24 XXXXXXXX-iPod Quicksilver[1286] <Warning>: optStatusGet response: status: 3

Mar 30 20:46:24 XXXXXXXX-iPod Quicksilver[1286] <Warning>: SetupViewController: viewWillDisappear:(animated=NO)

Mar 30 20:46:24 XXXXXXXX-iPod Quicksilver[1286] <Warning>: resumeSideloading

Mar 30 20:46:25 XXXXXXXX-iPod Quicksilver[1286] <Warning>: neverSetupTiVoStream: lastTSN==0x1dd01d90

Mar 30 20:46:25 XXXXXXXX-iPod lsd[1291] <Notice>: MS:Notice: Installing: (null) [lsd] (793.00)

Mar 30 20:46:28 XXXXXXXX-iPod Quicksilver[1286] <Warning>: ChannelListQuery complete: 442 channels

Wow. This is a lot of output. Now it is time for me to figure out what is occuring in this log by trying to match it up with the disassembled code...

Reverse Engineering the Tivo Stream

Saturday, March 30, 2013

TiVo App - Viewing the log for clues

Viewing the iOS logs

No comments:

Post a Comment