Intro
Recently I got a new tv subscription, which ships with an HD PVR; the Samsung SMT-C7140.
I did some research and I found out that there's no support for FTP or reading the HDD so I can view the recordings on my pc, due to "copyright issues". Other brands do allow this (such as Humax), but I don't want to spend additional money on that.
Thanks to a member from another forum (if you read this: thanks again!), I managed to get some progress, namely I'm able to get the recordings from the device, but I cannot play them. I'll write up what I have below. I am hoping that you, with all the experience from RE'ing Samsung TVs, are able to help me by identifying this device's way of storing recordings (like BD players use D series techniques) so I can watch them on my pc.
Accessing the storage
The device has a built-in media library, with a basic file browser, and supports reading from USB devices. Besides FAT, it supports EXT and XFS partitions.
Thus, using a Ubuntu VM, I formatted a USB drive as EXT3 and added a symlink to / (root). I can now access the device's internal storage and copy files to my USB drive using the media library file browser. It appears the device is running on a custom version of Linux.
Connectivity
The device is connected to my network using a Wi-Fi dongle. I did a quick port scan, but nothing seems to be open, unfortunately.
Stored recordings
The storage of the recordings seems to be divided in three sections:
- One file with an overview of all recordings
- Recording metadata
- Raw recording files
Recording overview
These are stored in a (partly Polish) XML file as /mnt/system/ccht.xml.
Code: Select all
<?xml version="1.0" encoding="utf-8"?>
<KeszItems Stamp="1374660770" >
<Plik F="/hdd/goss4#rec#.tv" N="Teen Cribs" D="38" Date="1374667890" Ch="MTV" VP="xmlTVRC:" W="False" />
</KeszItems>F: Folder path to metadata
N: Name of recorded show
D: Duration in seconds
Date: Timestamp of recording
Ch: Recorded channel name
VP: Video protocol?
W: Unknown (always False for me)
Recording metadata
These are stored in a folder called /hdd/XXXXX#rec#.tv with XXXXX being 5 alphanumeric characters, or ".ts" for the timeshift buffer. The folder contains the following (extension-less) binary files (I don't have RE experience, so not everything is known to me):
md: Some index as header, contains metadata (show info) and paths to raw recording files
mga: Contains the same metadata, followed by some index or checksums
mga1: Unknown, some checksum? The same for all my recordings so far
Strangely enough, some metadata are inside the show info (e.g. "Weekly news ov ENG erview").
Raw recording files
The raw recording files are stored in /mnt/hdd/.vfs/X/X/X/XXXXXXXX with X being a random letter between A and M. Because of this deeply nested structure and random names, finding recording files is not that easy.
From the "md" file, one can find the files for a specific recording. For my short recording, they are:
.vfs/f/a/e/hfglblfe
.vfs/g/d/g/cjbafbcf
.vfs/e/g/b/ekmikead
.vfs/f/c/i/fiddflek
.vfs/k/j/k/ebjlbgfe
The first file is ~25 MB and contains the video. All the other files seem to be index files, except the forth one, which contains the show info metadata (three times, strangely enough. Probably previous and next show, which were the same show because of a marathon).
When I remove the 512 bytes empty header from the large file, I can "play" it with VLC. Here's the media info:
However, the video is blockery, there is no audio (or completely distorted) and the supposed subtitles don't work. I suppose it's encrypted with DRM.
I've tried DRMDecrypt with the checksum(?) from "mga1", but it just says "OK" and spits out a zero-bytes file.
Firmware
I've created a partial firmware dump using the media library. However, not every folder could be copied successfully because of too many subfolders, files and symlinks that the device tries to copy everytime again (device keep saying "Please wait" forever and goes into stand-by eventually), or a copy error.
Everything except /dev, /sys and /proc should be complete. Maybe it can help you figuring out what this device does and uses. If you need a file from those three folders, let me know and I can copy the specific file instead of the whole folder.
Actually, I didn't test if I can copy files TO the internal storage. Maybe I can (and install a FTP client?). But there doesn't seem to be a port open so I can't execute commands for now.
Links
Code: Select all
Recording: https://mega.co.nz/#!W9JSWQqD!SbPBIRR1Cui4hldu_zU3JjRK1b9nllvmgm-rZ8FFaqk
Storage dump: https://mega.co.nz/#!G0Q0hKQI!cCA1B1WuQKP89K5hIPi0YiqdXUxD_c_thpDQhGCACGM
The main thing I'm keen to find out is how to play the recordings on my pc. I can write simple tools that can read the .vfs file names from the metadata files, but figuring out the index, metadata and decryption are things that are way above my head. That's way I've come to this forum to see if there are experts here that can find out how the video files are encrypted. Maybe it's the same technique used for a TV that has been investigated thoroughly already.
I really hope you can help me out with this.
Thanks a lot in advance!
