Humax 4tune

2015-01-20 @ 20:36:34

humax
pvr
tv

here.

I recently bought a Humax 4tune (hms1000t). I’m rather liking in so far: 4 tuners, a reasonable UI.

I would like to be able to get it to do a bit more, so I’ve started investigating it. It shows the following ports as being open:

Port Scan has started…

Port Scanning host: 10.0.1.30

	 Open TCP Port: 	21     		ftp
	 Open TCP Port: 	139    		netbios-ssn
	 Open TCP Port: 	445    		microsoft-ds
	 Open TCP Port: 	9000   		cslistener
	 Open TCP Port: 	9251
	 Open TCP Port: 	9252
	 Open TCP Port: 	36666
	 Open TCP Port: 	36667
	 Open TCP Port: 	48629
	 Open TCP Port: 	50001
	 Open TCP Port: 	55200
	 Open TCP Port: 	56789
	 Open TCP Port: 	56790
	 Open TCP Port: 	58816
	 Open TCP Port: 	60001

Port Scan has completed…

Obviously, I’ve turned on the FTP and Samba services.

Port 9000 appears to be an RTSP service:

$ curl http://<ip-address>:9000
RTSP

Ports 9251 and 9252 respond with:

{"errorCode": 404, "errorDescription":"Specified WID not found"}

The latter requires HTTPS, but uses a certificate for the domain name htvdev.humaxtvportal.com. The humaxtvportal.com domain is registered.

Port 36666 responds with:

RTSP/1.0 200 OK
CSeq: (null)
Apple-Jack-Status: connected; type=analog

Port 50001 responds with an XML document:

<?xml version="1.0" encoding="utf-8"?>
<root xmlns="urn:schemas-upnp-org:device-1-0" xmlns:dlna="urn:schemas-dlna-org:device-1-0" xmlns:hmx="urn:schemas-humax-co-kr:metadata-1-0"  >
  <specVersion>
    <major>1</major>
    <minor>0</minor>
  </specVersion>
  <device>
    <deviceType>urn:schemas-upnp-org:device:MediaServer:1</deviceType>
    <hmx:X_HMXCAP>TSR,MULTIVALUE,RCUTYPE_LIME,HX_N_ALL_P</hmx:X_HMXCAP>
    <dlna:X_DLNACAP xmlns:dlna="urn:schemas-dlna-org:device-1-0"></dlna:X_DLNACAP>
    <dlna:X_DLNADOC xmlns:dlna="urn:schemas-dlna-org:device-1-0">DMS-1.50</dlna:X_DLNADOC>
    <friendlyName>Lounge 10.0.1.30</friendlyName>
    <manufacturer>HUMAX</manufacturer>
    <manufacturerURL>www.humaxdigital.com</manufacturerURL>
    <modelDescription>HUMAX Set-Top Box OCTO2.0 Platform</modelDescription>
    <modelName>HMS1000T</modelName>
    <modelNumber>undefined</modelNumber>
    <modelURL>http://www.humaxdigital.com</modelURL>
    <serialNumber>None</serialNumber>
    <UDN>uuid:B38D5042-B86E-44F0-A758-F4F8BD6E3053</UDN>
    <icube:X_WOON_PAIRING xmlns:icube="urn:schemas-icube-co-kr:WoonDevice-1-0">hmx_base_08eb74e20b66</icube:X_WOON_PAIRING>
    <iconList>
      <icon>
        <mimetype>image/jpeg</mimetype>
        <width>48</width>
        <height>48</height>
        <depth>24</depth>
        <url>/icon/dms_48.jpg</url>
      </icon>
      <icon>
        <mimetype>image/png</mimetype>
        <width>48</width>
        <height>48</height>
        <depth>24</depth>
        <url>/icon/dms_48.png</url>
      </icon>
      <icon>
        <mimetype>image/jpeg</mimetype>
        <width>120</width>
        <height>120</height>
        <depth>24</depth>
        <url>/icon/dms_120.jpg</url>
      </icon>
      <icon>
        <mimetype>image/png</mimetype>
        <width>120</width>
        <height>120</height>
        <depth>24</depth>
        <url>/icon/dms_120.png</url>
      </icon>
    </iconList>
    <serviceList>
      <service>
        <serviceType>urn:schemas-upnp-org:service:ConnectionManager:1</serviceType>
        <serviceId>urn:upnp-org:serviceId:ConnectionManager</serviceId>
        <SCPDURL>ConnectionManager/scpd.xml</SCPDURL>
        <controlURL>ConnectionManager/control</controlURL>
        <eventSubURL>ConnectionManager/event</eventSubURL>
      </service>
      <service>
        <serviceType>urn:schemas-upnp-org:service:ContentDirectory:1</serviceType>
        <serviceId>urn:upnp-org:serviceId:ContentDirectory</serviceId>
        <SCPDURL>ContentDirectory/scpd.xml</SCPDURL>
        <controlURL>ContentDirectory/control</controlURL>
        <eventSubURL>ContentDirectory/event</eventSubURL>
      </service>
    </serviceList>
  </device>
</root>

This appears to be DLNA-related.

Likewise with port 55200:

<?xml version="1.0" encoding="utf-8"?>
<root xmlns="urn:schemas-upnp-org:device-1-0">
  <specVersion>
    <major>1</major>
    <minor>0</minor>
  </specVersion>
  <device>
    <dlna:X_DLNADOC xmlns:dlna="urn:schemas-dlna-org:device-1-0">DMR-1.50</dlna:X_DLNADOC>
    <deviceType>urn:schemas-upnp-org:device:MediaRenderer:1</deviceType>
    <friendlyName>Lounge</friendlyName>
    <manufacturer>HUMAX</manufacturer>
    <manufacturerURL>http://www.humaxdigital.com</manufacturerURL>
    <modelDescription>HUMAX Set-Top Box OCTO2.0 Platform</modelDescription>
    <modelName>HMS1000T</modelName>
    <modelNumber>undefined</modelNumber>
    <modelURL>http://www.humaxdigital.com</modelURL>
    <serialNumber>[redacted]</serialNumber>
    <UDN>uuid:B38D5042-B86E-44F0-A758-F4F8BD6E3053</UDN>
    <serviceList>
      <service>
        <serviceType>urn:schemas-upnp-org:service:AVTransport:1</serviceType>
        <serviceId>urn:upnp-org:serviceId:AVTransport</serviceId>
        <SCPDURL>AVTransport/scpd.xml</SCPDURL>
        <controlURL>AVTransport/control</controlURL>
        <eventSubURL>AVTransport/event</eventSubURL>
      </service>
      <service>
        <serviceType>urn:schemas-upnp-org:service:ConnectionManager:1</serviceType>
        <serviceId>urn:upnp-org:serviceId:ConnectionManager</serviceId>
        <SCPDURL>ConnectionManager/scpd.xml</SCPDURL>
        <controlURL>ConnectionManager/control</controlURL>
        <eventSubURL>ConnectionManager/event</eventSubURL>
      </service>
      <service>
        <serviceType>urn:schemas-upnp-org:service:RenderingControl:1</serviceType>
        <serviceId>urn:upnp-org:serviceId:RenderingControl</serviceId>
        <SCPDURL>RenderingControl/scpd.xml</SCPDURL>
        <controlURL>RenderingControl/control</controlURL>
        <eventSubURL>RenderingControl/event</eventSubURL>
      </service>
    </serviceList>
  </device>
</root>

Port 56789 returns a 404: I’m guessing we can figure out a path that might work.

Port 56790 is a “DIAL SERVER”:

<?xml version="1.0" encoding="utf-8"?>
<root xmlns="urn:schemas-upnp-org:device-1-0" xmlns:r="urn:restful-tv-org:schemas:upnp-dd">
  <specVersion>
    <major>1</major>
    <minor>0</minor>
  </specVersion>
  <device>
    <deviceType>urn:schemas-upnp-org:device:tvdevice:1</deviceType>
    <friendlyName>HMS1000T - DIAL SERVER:10.0.1.30</friendlyName>
    <manufacturer>HUMAX</manufacturer>
    <manufacturerURL>http://www.humaxdigital.com</manufacturerURL>
    <modelDescription>HUMAX Set-Top Box OCTO2.0 Platform</modelDescription>
    <modelName>HMS1000T</modelName>
    <modelNumber>undefined</modelNumber>
    <modelURL>http://www.humaxdigital.com</modelURL>
    <serialNumber>[redacted]</serialNumber>
    <UDN>uuid:B38D5042-B86E-44F0-A758-F4F8BD6E3053</UDN>
    <serviceList>
      <service>
        <serviceType>urn:dial-multiscreen-org:service:dial:1</serviceType>
        <serviceId>urn:dial-multiscreen-org:serviceId:dialControl</serviceId>
        <SCPDURL>dial/scpd.xml</SCPDURL>
        <controlURL/>
        <eventSubURL/>
      </service>
    </serviceList>
  </device>
</root>

Port 58816 rejects connections, but port 60001 is an interesting one:

$ telnet [address] 60001
Trying [address]...
Connected to [address].
Escape character is '^]'.
root:> help
* help [root:]
** registered process list
    corsair                     homma                       prism                       obama
    sama                        ipepg
** helpall : display all command set
root:> helpall
* help all
[corsair]
  [mem]
     printmem         :  print memory usage to outputfile
     memconf          :  configuration of printmem
     memcheck         :  check memory corruption - if corrupted, log in corrupted.log
     currsec          :  print the current second from the boot
  [RLIB]
     print_rsc        :  print Resource Info
  [OAPI]
     oapi_output_vid  :  oapi_output_video debug api call
     oapi_output_hdm  :  oapi_output_hdmi debug api call
[homma]
  [mem]
     printmem         :  print memory usage to outputfile
     memconf          :  configuration of printmem
     memcheck         :  check memory corruption - if corrupted, log in corrupted.log
     currsec          :  print the current second from the boot
  [RLIB]
     print_rsc        :  print Resource Info
[prism]
  [mem]
     printmem         :  print memory usage to outputfile
     memconf          :  configuration of printmem
     memcheck         :  check memory corruption - if corrupted, log in corrupted.log
     currsec          :  print the current second from the boot
  [ONDK]
     hello            :  help..
     vkcmd            :  vkcmd [mem/sem/task/timer]
     timerlist        :  timerlist
     gwmlist          :  gwmlist
  [OAPI]
     oapi_output_hdm  :  oapi_output_hdmi debug api call
[obama]
  [mem]
     printmem         :  print memory usage to outputfile
     memconf          :  configuration of printmem
     memcheck         :  check memory corruption - if corrupted, log in corrupted.log
     currsec          :  print the current second from the boot
  [pal_hdmi]
     hdcp_enable      :  HDCP on/off
     status           :  Print HDMI status.
     capa             :  Print HDMI TV capability.
     hdcp_event       :  Send HDCP event to appkit
     output           :  Enable/Disable HDMI output.
     avinfo           :  Set AVI infoframe.
  [OM]
     om_output_hdmi   :  om_output_hdmi debug api call
     om_output_video  :  om_output_video debug api call
  [PAL]
     pal_scl          :  pal scaler debug api call
     pal_scart        :  pal scart debug api call
     pal_out          :  pal out debug api call
     pal_video        :  pal video debug api call
     pal_audio        :  pal audio debug api call
  [RLIB]
     print_rsc        :  print Resource Info
  [SVC]
     svc_av           :  tv service /AV debug api call
     svc_out          :  svc out debug api call
[sama]
  [mem]
     printmem         :  print memory usage to outputfile
     memconf          :  configuration of printmem
     memcheck         :  check memory corruption - if corrupted, log in corrupted.log
     currsec          :  print the current second from the boot
  [RLIB]
     print_rsc        :  print Resource Info
  [SamaCmd]
     print_systime    :  print system time
     print_rpc        :  print SAMA rpc
     print_slot       :  print SAMA slot status
     print_sch        :  print SAMA Schedules
     print_timer      :  print SAMA Timer
     make_sch         :  make SAMA Schedule
     del_sch          :  delete SAMA Schedule
     make_ransch      :  make SAMA Schedule (TBR)
     del_sch_all      :  delete ALL SAMA Schedule
[ipepg]
  [mem]
     printmem         :  print memory usage to outputfile
     memconf          :  configuration of printmem
     memcheck         :  check memory corruption - if corrupted, log in corrupted.log
     currsec          :  print the current second from the boot
  [RLIB]
     print_rsc        :  print Resource Info
root:>

Oh my. More to come, I suspect…