FiOS TV HD STB Network Control Project - This is BIG!
-----------------------------------------------------


# # # ::: QUICK INFO

Project Code Name: VAG202

This projects purpose to to show how a Verizon FiOS HD STB can be 
controlled via a computer or any other device via a network. It is 
a result of reverse engineering the Verizon FiOS Mobile Remote App
for Android. Its currently only usable by advanced technical users,
but its intent is to be used as a source of information to build its 
functionality into other open source programs. 


# # # ::: CALL FOR HELP - NEED FOR ALPHA GEEKS LINUX OPEN SOURCE FOLKS AND CODERS

Today is June 27, 2010 the protocol has been reversed since June 10, 2010.
However its not done anyone but me any good because, there is a lack of testers
and developers to help and test and work on this stuff. Without additional testing
noone good will come of all this effort. Except for the acedemic exercise of reversing 
the protocol. Please come to #fiostv on freenode irc to help. or fork me.


# # # ::: RESOURCE AND ASSET ASSISTANCE

Reversing this protocol was very difficult and tedious.. highly technical and challenging to
say the least. If you are person looking to contribute to this project or other projects, I'd 
love to talk to you. I am interested in hacking things both technical and biological. My other 
interests include evolutionary and developmental biology, tissue regeneration and synthetic 
organisms, I'd love to work on such things, but I'm a poor code monkey and stuck working on 
real estate websites for corporate relocation. 
 

# # # - - - ::: Background - Yadda Yadda skip this section

Verizon is a interesting name, it has no official meaning, but it makes
me think of vertical horizon, maybe if somehow you could cut into the air
you could see all of the data traveling through it. I suppose they came
out of some mergers and such, I'm not a historian, but I do remember when
I was a kid we had bell atlantic and that disappeared into the ether.
Verizon wireless is another matter, around 2005 it was beginning to
become mandatory everyone have a cellphone, or you were simply a recluse.
I held out until 2007 personally. I hated the cellphones at the time, and
verizon had some stinkers, the main problem was the software.. Verizon
'get it now' enabled you to pay two dollars for a ringtone or even more
for a shitty snake game, what a nightmare. I hated that crap, I got the
lowest phone possible in 2007 and waited for linux to take over the world
as it most certainly will. Well it looks like Verizon used all those
ringtone buying fools money wisely, and upgraded there network
constantly. Then I guess sometime in 2009 they decided, enough horse
shit, lets take this to the next level, finally in November the Droid was
released. The perfect child of open source hackers and cut throat
corporate suits. Meanwhile back in the day on land, DSL came into
existence and sucked immensely to no ones surprise, better than that 33.6
modem tho. Then FiOS comes along, fuck yeah, thats the way to do it. But
damn its only available in the rich part of some area I don't live. (This
is still an issue.) Fast forward to early 2010 and Verizon releases a
mobile app that lets you control the television using you phone. Yes. Can
you hear me now? The droid isn't so much a phone as it is a mobile
computer with phone capabilities, and of course it should control the TV,
and let you in the door and start the car and the whole nine yards. Three
screens and a cloud.. who said that? Wait that other screen, the
computer, it should be able to control the tv too, and via a IP network,
not some rig up with an IR Blaster, are you kidding me? Maybe the
computer could change the channel on a schedule. Perhaps it could change
the channel on every TV in the house at the same time. Maybe it could use
information from a social network to determine when commercials were on
and mute the TV. Maybe during commercials you could switch channels but
then the computer switches back to moment the show returns. Maybe you
could subscribe to someone else's viewing habits so your channel is
synced to there channel. Maybe your just a worn out person falling down
on the couch after a long day of talking on your verizon wireless phone
and checking facebook, you don't know what you want to watch but you want
to be entertained, so the computer cycles through your favorite channels
until you tell it to stop. Whatever the use-case is, obviously your
mobile computer and computer should be able to control the TV, and
control it over an IP network.

The Verizon FiOS mobile remote is pretty neat, it lets you do all the
normal functions of the remote, it lets you send photos from your mobile
to the tv screen instantly (with a 4 second lag of course), and it lets
you set favorites by creating a custom icon based menu with the logos of
your favorite channels. Did I mention that I thought the idea of 'channel
numbers' seems pretty out dated with 2000 channels? Shouldn't we browse
by tag or category or anything but numbers? The software is a lil bit
clunky in some senses tho, it doesn't work in landscape mode, its
interface on android is a bit nonstandard.. and it uses some kind of
bizarre network protocol that looks like something a news station control
center would have used in the early nineties.

The network protocol used by the FiOS mobile remote to control the STB's
(HD only, for some reason.) is binary and not plaintext or xml or
anything sensible. Its connection process is somewhat backwards and it
has several security mechanisms, however it is not encrypted. One would
have to stay up all night long for many nights in some kind of drug
induced frenzy staring at hex codes from sniffed packets, trying to find
correlation's and patterns in order to crack it. Well something along
those lines happened.


# # # - - - ::: Current Situation

The protocol from the FiOS Mobile Remote Application has been reverse
engineered, and I am able to control my TV from my computer via IP
network without any requirement of the FiOS mobile remote application.
However the set of security codes maybe unique to each box, thats really
not a problem as the way to crack it is the same, its just a matter of
determining what its necessary to get a fresh STB talking to the
computer.

I am a Ruby and C developer, and I used arpspoof, wireshark, my brain to
reverse the protocol. I wrote ruby programs that connect to the STB
pretending to be mobile remote and programs that let the mobile remote
connect to them pretending to be a STB.

The code is currently somewhat of a rats nest, and there is several
implementations of the same thing. The idea is here is just to get
something up and working reliably and then someone can write a standard
library in whatever language they choose.


# # # - - - ::: Questions we want to answer from this testing

1) What is possible before installing the FiOS mobile remote widget? Is
this a service on the box that is always on? 2) Is there some kind of pin
number in the initial set up process? I can't recall... 3) Is this thing
running on the STB written in LUA using the SDK that Verizon will maybe
possibly be releasing for FiOS STBs? 4) Are the security codes the same
for each box?

# # # - - - ::: Future issues

Verizon could change the protocol or patch all the security issues at any
time. I think this is unlikely because of the nature of the strange
protocol, and I think fixing it would require a complete rewrite of the
STB, android and iphone apps. Who knows tho.

If someone from Verizon ever reads this, just open the protocol, and have
it use some standard security such as um.. a password? Just to prevent
virus writers and nefarious folk from causing a ruckus. Having the mobile
or home computer or laptop be able to control the TV is the future, and
you know it, keeping the protocol proprietary is just old thinking, more
money and fun is in the open.


# # # - - - ::: Technical

SEE README_TECHNICAL


# # # - - - ::: FAQ 


Q) What does this have to do with MythTV? 
A) Nothing yet, these programs are completely independent from anything else at this time, however 
once the protocol and initial connection process is better understood, a standard library, and standard 
toolkit can be built that MythTV and any other program could then use to control the STB's

Q) WTF are FiOS TV Widgets and how do they relate to this?
A) FiOS TV Widgets are like apps for your STB, they use the same clunky interface as the menu system, 
they do things like show you twitter messages, weather, or help you shop on HSN. They are probably 
written in the LUA language. Verizon is seemingly going to open up widget development with a SDK, 
but they have not done so yet. The normal set up sequence of the FiOS mobile remote involves activating 
a mobile remote widget.

https://www22.verizon.com/fiosdeveloper/General/FiosDevCenterExt.aspx

Q) What is a good reason Verizon Sucks?
A) They charged me $70 of overage for calling a Verizion FiOS landline from a Verizon Wireless Cell Phone.

# # # - - - ::: CONTACT

#fiostv on FREENODE irc, you can get to this chat room by going to this web page:

http://webchat.freenode.net/?nick=fiosguy&channels=#fiostv
 
or using an IRC program

My nick is oneman or rawdod

http://industrialstrengthinc.com
http://rawdod.com

r - a wdod AT gee mail dot com   (remove the spaces and dashes change gee mail to gmail and AT to @)

David Richards

# # # - - - ::: LEGAL 

This code was created by hand from analyzing the in the clear packet transmissions of the verizon fios mobile remote.
No part of the code is owned or created by verizon. With the exception of the 'connecting.png' image which is a peice
of crap anyway, and if THIS IS A BiG DEAL then I will remove it.

Reverse engineering for purposes of interoperability is a protected right under the DMCA. 

Atleast I think it is, im not a fucking god damn lawyer. 

The Program itself 'VAG202' is licensed under the GPL version 3. If you want to give me some money I can release 
a version to you under a different license or do some other work for you. If you take the code and use
it in your own program and don't release the source code, yet relese to the program to anyone but yourself,
then your a massive dick. If your just screwing around with it, thats fine, but if you learn something, do share.
If you double reverse engineer the protocol by reading this code and writing your own code then im not sure 
your in any kind of violation, but I still think you should give me some money. 

Verizon FiOS, This is BiG, Verizon Wireless are trademarks of Verizon Megacorp Inc. Used in fairness.

      Permission is granted to copy, distribute and/or modify this
      document under the terms of the GNU Free Documentation License,
      Version 1.3 or any later version published by the Free Software
      Foundation; with no Invariant Sections, no Front-Cover Texts and
      no Back-Cover Texts.  A copy of the license is included in the
      section entitled "GNU Free Documentation License".


# # # - - - ::: MEDICAL


USE OF THIS PROGRAM OR READING OF THIS DOCUMENT IS CONSIDERED BUT NOT PROVEN SAFE WITH MOST MEDICATIONS
POSSIBLE SIDE EFFECTS INCLUDE: NAUSEA AND VOMITING, RAPID BEARD GROWTH AND COCKEYE. IF THESE SYMPTOMS 
PERSIST OR ARE BOTHERSOME DISCONTUNINUE USE AND CONSULT YOUR LOCAL RASTAFARIAN