Private: implementing esg - Revision history

MediaWiki default: Private: mobile tv shoutbox moved to Private: implementing esg

2009-10-11T15:32:49Z

Private: mobile tv shoutbox moved to Private: implementing esg

Yliu at 18:17, 20 October 2008

2008-10-20T18:17:55Z

Yliu at 18:14, 20 October 2008

2008-10-20T18:14:36Z

Yliu at 17:58, 20 October 2008

2008-10-20T17:58:39Z

Yliu at 17:45, 20 October 2008

2008-10-20T17:45:22Z

Yliu at 17:38, 20 October 2008

2008-10-20T17:38:18Z

Yliu at 19:56, 17 October 2008

2008-10-17T19:56:17Z

MediaWiki default at 16:40, 13 October 2008

2008-10-13T16:40:25Z

MediaWiki default at 16:40, 13 October 2008

2008-10-13T16:40:00Z

MediaWiki default at 16:39, 13 October 2008

2008-10-13T16:39:40Z

← Older revision		Revision as of 18:17, 20 October 2008
Line 165:		Line 165:
	And do remember to use DVBSam which is very powerful. Divicatch in most case can not help much on ESG part!		And do remember to use DVBSam which is very powerful. Divicatch in most case can not help much on ESG part!

		+
		+
		+	===Compare OMA BCAST ESG used in N96.ts with our current implementation===
		+
		+	The OMA BCAST ESG in N96.ts is much more complex than our current. It has 9 containers, self contain 93 SDP files , 29 xml files and 19 DU files.
		+
		+	Ours only has 1 DU file, 1 SDP, 4 xml files.
		+
		+	I did not do much on this direction due to time limit.

← Older revision		Revision as of 18:14, 20 October 2008
Line 98:		Line 98:

	Our USB analyzer software can not even read the ESG that works on Nokia N96 cell phone!		Our USB analyzer software can not even read the ESG that works on Nokia N96 cell phone!
−


Line 117:		Line 116:
	===Compare IPDC ESG form N96.ts with our current implementation===		===Compare IPDC ESG form N96.ts with our current implementation===

		+	One obvious error of our current IPDC ESG implementation is in urn:dvb:ipdc:cid:2
		+
		+	The length of ESG data repository is wrong, should be 00 0B 53 instead of the original 00 07 5E , such that the whole SDP can be transferred.
		+
		+
		+	The IPDC ESG used insider N96.ts:
		+
		+	* Originally sent in gzip format
		+
		+	* After unzip, self contains 17 outline SDP files, 5 image files (one for each video program) and 7 XML files
		+	19_Acquisition.xml
		+	19_Content.xml
		+	19_PurchaseChannel.xml
		+	19_Purchase.xml
		+	19_Schedule.xml
		+	19_ServiceBundle.xml
		+	19_Service.xml
		+
		+
		+	Our current IPDC ESG implementation:
		+
		+	* Not sent in gzip format, no need to unzip
		+
		+	* Self-contain 1 inline SDP file, 4 XML files
		+
		+
		+	The main difference is how we deal with SDP files, ours are created by VLC which may not works fine on N96 cell phone.
		+
		+
		+
		+	===Possible failure reason of our current implementation:===
		+
		+	* Might be inline SDP content has problems?
		+
		+	Actually we have not reached to parsing SDP step. So I use the word might be. As if only SDP fail, we should be able to still detect and select the ESG, but when we try to play the corresponding channel, the ESG will tell you no stream received (due to bad SDP)
		+
		+	* Maybe due to get too many ESG bootstrap
		+
		+	Using DVBSam, when I check ESG status, our testbed will refresh ESG very quickly (less than 10 seconds) That is to do a ESG Bootstrap again and again.
		+
		+	The bad thing is during a Boorstrap, it will delete all the existing ESG. So maybe the cell phone is trying to receive the actual ESG, but out testbed sends a ESG bootstrap message and delete all the ESG the cell phone
		+	is trying to receive. (which equals to a refresh in DVBSam ESG monitor)
		+
		+	And in real DVB-H TS, we can easily see there is no such kind of refresh for ESG. After bootstrap ,we get the actual ESG and they are always sitting there!
		+
		+	Obviously, the real world DVB-H TS is using an ESG server to populate the ESGs , and we are using flute tool, I do not know how to get rid of more than necessary ESG Bootstrap based on our current implementation.

		+	And do remember to use DVBSam which is very powerful. Divicatch in most case can not help much on ESG part!

@@ Line 34: / Line 34: @@
 It includes two ESGs, one is Nokia OAI, the other is early verion of CBMS
-[trial with cell phone device]
+[Trial with cell phone device]
 N92 cell phone can load Nokia OAI ESG very well and play the corresponding program. and can not load CBMS ESG.
@@ Line 41: / Line 41: @@
 N96 failed to load any of the above ESGs.
-[trial with software analyzer]
 ) DiviCatch can not detect Nokia OAI ESG, can find CBMS ESG running on port 3937 but failed on bootstrap steps.
 ) DVBSam can see Nokia OAI ESG Bootstrap running on FF05:0000:0000:0000:0000:0000:0000:012D with port 9214 , can pass bootstrap steps but failed on ESG receive; can see CBMS ESG running on 224.0.23.14 with port 3937,  can pass bootstrap steps but failed on ESG receive
 [Conclusion]
 It seems like early version of ESG are not supported by current analyzer and latest cell phones.
@@ Line 59: / Line 65: @@
    Guard Interval 1/8
    Transmission-mode 8k
 It includes three types of ESGs, 1st is OMA BCAST, 2nd is DVB IPDC, and the 3rd is Prestandard OMA BCAST and they all use port 9214.
@@ Line 72: / Line 93: @@
 * Try to load OMA ESG/Prestandard OMA BCAST by divicatch : this can pass bootstrap step and then will crash the Divicatch software during ESG reception.
 [Conclusion]
 Our USB analyzer software can not even read the ESG that works on Nokia N96 cell phone!
 * DVBSam failed to receive Prestandard OMA BCAST
 * DVBSam can receive IPDC ESG and OMA BCAST ESG successfully.
 [Conclusion]
 Either IPDC ESG or OMA BCAST ESG in N96.ts is valid for Nokia N96 cell phone.
 I have put ESG Bootstrap data, IPDC ESG, OMA BCAST ESG for this TS in \\students\yliu\DVBH_debug\ESG

← Older revision		Revision as of 17:45, 20 October 2008
Line 49:		Line 49:
	[Conclusion]		[Conclusion]
	It seems like early version of ESG are not supported by current analyzer and latest cell phones.		It seems like early version of ESG are not supported by current analyzer and latest cell phones.
		+
		+
		+	===Analyze of N96 DVB-H Transport Stream===
		+
		+	For N96.ts, its transmission parameters are as follows:
		+	Frequency 690 MHz
		+	Modulation QPSK
		+	Code Rate 2/3
		+	Guard Interval 1/8
		+	Transmission-mode 8k
		+
		+	It includes three types of ESGs, 1st is OMA BCAST, 2nd is DVB IPDC, and the 3rd is Prestandard OMA BCAST and they all use port 9214.
		+
		+	N92 cell phone can NOT load any of the above ESGs
		+
		+	N96 can load ESG and play the video.
		+
		+	But since this TS file only has one int table, so three types of ESG are mixed up together. So the goal is to find which is the actual working ESG on N96.
		+
		+
		+	* Try to load IPDC ESG by divicatch : this can pass bootstrap step and then will crash the Divicatch software during ESG reception.
		+
		+	* Try to load OMA ESG/Prestandard OMA BCAST by divicatch : this can pass bootstrap step and then will crash the Divicatch software during ESG reception.
		+
		+	[Conclusion]
		+
		+	Our USB analyzer software can not even read the ESG that works on Nokia N96 cell phone!
		+
		+	* DVBSam failed to receive Prestandard OMA BCAST
		+
		+	* DVBSam can receive IPDC ESG and OMA BCAST ESG successfully.
		+
		+	[Conclusion]
		+
		+	Either IPDC ESG or OMA BCAST ESG in N96.ts is valid for Nokia N96 cell phone.
		+
		+	I have put ESG Bootstrap data, IPDC ESG, OMA BCAST ESG for this TS in \\students\yliu\DVBH_debug\ESG

@@ Line 1: / Line 1: @@
-===Crack Nokia S60 OS to see all system files===
+===Debug tools===
-N92: S60 3rd edition (crack successfully)
+We have the following software analyze tool:
-N96: S60 3rd edition with FP2 (not yet)
+) Divicatch + USB Analyzer
-  Steps: (all files are available on network shared drive, under  students\yliu\testbed\s60crack )
+) DVBSam + WinTV DVB-T USB
-On N92, now we have full control of all the files.  On N96, we can access all files except system protected files (C:\sys  and C:\private).
 ===DVB-H related info found on N92===
-C:\dvbh.ini   (N92 only has a C drive)
+C:\dvbh.ini
    ScheduleItemRemovalInterval=7

← Older revision	Revision as of 15:32, 11 October 2009
(No difference)

← Older revision		Revision as of 19:56, 17 October 2008
Line 1:		Line 1:
		+	===Crack Nokia S60 OS to see all system files===
		+	N92: S60 3rd edition (crack successfully)
		+
		+	N96: S60 3rd edition with FP2 (not yet)
		+
		+	Steps: (all files are available on network shared drive, under students\yliu\testbed\s60crack )
		+	1) Install X-plore: this tool is a powerful file browser and can help us view all the system files and hidden files.
		+	2) Install HelloCarbide.sisx : this tool can be used to temporarily disable the root certificate on the cell phone
		+	3) Upload installServer.exe and CProfDriver_SISX.ldd to the C:\sys\ on cell phone : this is to replace root certificate and gain system access
		+	4) Install CapsOn,sisx and CapsOff.sis : the switch to control the cracking.
		+
		+	On N92, now we have full control of all the files. On N96, we can access all files except system protected files (C:\sys and C:\private).
		+
		+
		+	===DVB-H related info found on N92===
		+	C:\dvbh.ini (N92 only has a C drive)
		+
		+	ScheduleItemRemovalInterval=7
		+	AutoScanNwTimeRetryDelay=5
		+	ESGRootPort=9214
		+	IpdcNumberOfLogFiles=3
		+	IpdcLogFile=ipdc.txt
		+	IpdcLogDir=ipdc
		+	IpdcLogLevel=1
		+	IpdcLogLevelRDebug=9
		+	IpdcLoggingEnabled=1
		+	NifFwdToStackInterval=500
		+	NifReadInterval=500
		+	SocketRecvBufSize=800000
		+	TerminalMaximumBandwidth=500000
		+	RequiredDiskFreeSpacePercentage=5
		+	AllowUsageTracking=1
		+	SignalScanFreqLow=472000000
		+	SignalScanFreqHigh=702000000
		+	SignalScanBW=8000000
		+	SignalScanType=1
		+	AutoScanEnabled=1
		+	AutoScanStartDelayAfterBoot=5
		+	AutoScanInterval=10800
		+	AutoScanPreferredPlatformId=-1
		+	AutoScanPlatformSetRetryDelay=120
		+	PlatformSetUniversalTimeout=60
		+	ScanUniversalTimeout=600
		+	NetworkTimeUpdateUniversalTimeout=35
		+	BootUniversalTimeout=20
		+	InactivityPowerOffTime=300
		+	ER4BootImageFile=z:\spi_boot.img
		+	ER4SWImageFile=z:\enginer4.img
		+	ER4AntennaSetup=z:\ER4AntennaSetup.dat
		+	ER4SetPlatformRetryTimeout=25000
		+	ER4SetPlatformRetryCount=10
		+	ESGMgrUpdTime=120
		+	ESGMgrUpdTimeAfterErr=10
		+	ESGMgrUpdInterval=180
		+	ESGMgrUpdRestartCount=3
		+	ESGMgrRxInitTime=30
		+	ESGMgrRxPeriodChkTime=20
		+	ESGMgrUpdateEnabled=1
		+	ESGMgrFCastRestartCount=3
		+	ESGMgrUpkeepCleaningDelay=20160
		+	ESGMgrCarouselDeltaStartTimeInHours=48
		+	UsageTrackerRetryInterval=1
		+	UsageTrackerRetryCounts=5
		+	ECRenewalTime=1800000000
		+	ECRenewalOffset=1
		+	ECRemovalTimeInHours=48
		+	AutoScanPlatformSetRetries=1
		+	NwTimeUpdateRetries=2
		+	PowerOffDelayAfterNwDiscovery=3
		+	ReplayBuffer=30
		+	UsageTrackerDbUpperLimit=1000000
		+	DRMClockUpdateInterval=30
		+
		+
		+	===Error message found on N96===
		+
		+	Based on N92 dvbh.ini config file, I guess on N96, DVBH.img is either ER4BootImageFile=z:\spi_boot.img
		+	or ER4SWImageFile=z:\enginer4.img on N92. And it sounds more like the complete image, not just the boot image.
		+
		+	And even though N96's dvbh.ini file is short, it seems like some parameters still follows the N92's example, for example
		+	the log files on N96 matched with N92's config file
		+
		+	IpdcNumberOfLogFiles=3
		+	IpdcLogFile=ipdc.txt
		+	IpdcLogDir=ipdc
		+	IpdcLogLevel=1
		+	IpdcLogLevelRDebug=9
		+	IpdcLoggingEnabled=1
		+
		+	In DVBH.img we find the following readable error message:
		+	PSI_Processor PSI_patpmt PSI_nitint
		+
		+	ThreadX API error: The event group is already created. Threadx API error: Invalid event group pointer. The pointer is NULL. System timer thread obj\dvbh\dtv1000_dbg
		+
		+
		+	As the above error message happens after the PSI/SI info section, It is the next step--ESG Bootstrap on Cell phone that cause the above error lines. The cell phone tried to receive something and the application crashed. So on N96 the Subsystem ESG Manage did not get anything and leads to timeout.
		+
		+
	=== TS files for various ESG versions available on-line (Mon Oct 13 09:30:11 PDT 2008) ===		=== TS files for various ESG versions available on-line (Mon Oct 13 09:30:11 PDT 2008) ===

@@ Line 1: / Line 1: @@
 === TS files for various ESG versions available on-line (Mon Oct 13 09:30:11 PDT 2008) ===
-There is a recent DVB-H trial that adopts multiple ESG versions. A final report can be found at [http://www.dvb-h.org/PDF/Mobile%20World%20Congress%20Abertis%20Telecom%20Receivers%20V3.2.pdf | here]. In this trial, two types of Nokia ESG platforms are used: OAI and OMA BCAST. They also made some ts files available on an ftp site (see pp.18 in the above report).
+There is a recent DVB-H trial that adopts multiple ESG versions. A final report can be found at [http://www.dvb-h.org/PDF/Mobile%20World%20Congress%20Abertis%20Telecom%20Receivers%20V3.2.pdf  here]. In this trial, two types of Nokia ESG platforms are used: OAI and OMA BCAST. They also made some ts files available on an ftp site (see pp.18 in the above report).
 To reverse engineer the requirements of Nokia's OMA BCAST ESG implementation, we can download and analyze the ts files of Nokia BCAST platform. We can use the channel parameters listed in the report to identify the right ts stream.

@@ Line 51: / Line 51: @@
 </pre>
-=== Comments from Mr. Hanel, who is an engineer at Decontis (the company who makes dvbSAM): ===
+=== Comments from Mr. Hanel, who is an engineer at Decontis (the company who makes dvbSAM) ===
 Nokia is a special case. It is correct that Nokia moves from its own

← Older revision		Revision as of 16:39, 13 October 2008
Line 1:		Line 1:
		+	=== TS files for various ESG versions available on-line (Mon Oct 13 09:30:11 PDT 2008) ===
		+
		+	There is a recent DVB-H trial that adopts multiple ESG versions. A final report can be found at [http://www.dvb-h.org/PDF/Mobile%20World%20Congress%20Abertis%20Telecom%20Receivers%20V3.2.pdf \| here]. In this trial, two types of Nokia ESG platforms are used: OAI and OMA BCAST. They also made some ts files available on an ftp site (see pp.18 in the above report).
		+
		+	To reverse engineer the requirements of Nokia's OMA BCAST ESG implementation, we can download and analyze the ts files of Nokia BCAST platform. We can use the channel parameters listed in the report to identify the right ts stream.
		+
	=== To debug buffer overflow problems (Sun Oct 5 14:57:03 PDT 2008) ===		=== To debug buffer overflow problems (Sun Oct 5 14:57:03 PDT 2008) ===