# Executing flash code on series 4 units



## moyekj (Jan 24, 2006)

Over this past weekend I discovered a way to execute flash (swf) via the Series 4 RPC protocol. i.e. Execute an arbitrary flash (swf) url such as:

```
http://www.bbc.co.uk/science/humanbody/sleep/sheep/reaction_version5.swf
```
Note that with the above flash example I was able to get Premiere to respond to left/right/select remote presses so looks at least some rudimentary remote control input seems to be possible.

NOTE: This works whether using SDUI or HDUI.

I know very little about flash programming but exploring a little more I made a simple "Hello World!" ActionScript 2 script and compiled to swf with the free mtasc compiler and served up the resulting swf to my Premiere via a simple Python web server and verified that it ran.

Don't know if a fully custom flash application responding to various remote control presses is possible and if for example serving up video through flash would be possible as well. Above simple "Hello World!" script is as far as I got. I tried to do a little with event listeners to see if I could figure out how to capture remote control presses but didn't get anywhere with that.

At any rate I thought this was at least mildly interesting and figured I would post here to see if anyone perhaps with more flash experience has an interest in exploring this further. I can post some code for someone to get going on this and replicate what I have done so far if there is any interest.


----------



## Soapm (May 9, 2007)

Very interesting but it's to close to a way to brick your S4 for me to give it a try. And I'm the adventurous type...


----------



## wmcbrine (Aug 2, 2003)

DUDE.

Yes this is mildly interesting.  Moar plz.


----------



## moyekj (Jan 24, 2006)

OK, here's a zip package which I think has all the stuff to get started along with a README.txt summarizing each file:
http://kmttg.googlecode.com/files/TiVoFlash.zip

Basically to get started edit run.bat (Windows) or run.sh (Linux) to set your Series 4 IP and your 10 digit MAK and then just run the script.

Once you have the sheep swf working if you like you can make your own and use webserver to serve it up. Start with provided sample.swf file as starting point. You can test webserver with your browser first.

NOTE: If you give a bad URL you could hangup your Premiere GUI for a while (I've done it a couple of times). Use at your own risk, etc.
It's late so I may have messed up making the package. Let me know if something is missing or not clear.

(NOTE: I would have preferred to keep everything Python for simplicity but I'm not sure how to do socket PKCS12 authentication with Python and since kmttg.jar has pretty much everything needed I was lazy and just used it. Technically current software doesn't need PKCS12 authentication but it will be needed in "Spring" software release so I'm already ready for that.)


----------



## wmcbrine (Aug 2, 2003)

Um... source code for TiVoFlash.jar?


----------



## moyekj (Jan 24, 2006)

wmcbrine said:


> Um... source code for TiVoFlash.jar?


I don't have it with me right now, but the bottom line to execute flash is simply an RPC request with following JSON (substitute URL accordingly):

```
{"type":"uiNavigate","uiDestinationType":"flash","uri":"x-tivo:flash:URL","bodyId":"-"}
```
bodyId may have to be TSN but probably "-" as above works.

P.S. I found it by going through return values after querying uiDestinationType of type "flash" with following RPC request:

```
{"type":"uiDestinationInstanceSearch","uiDestinationType":"flash","levelOfDetail":"high","noLimit":"true"}
```
There's some more interesting stuff there if you go through the returned list.


----------



## wmcbrine (Aug 2, 2003)

I couldn't get your package to run on my Mac; it said 'Exception in thread "main" java.lang.NoClassDefFoundError: Main'. Anyway, I took the info from above and put it into a Python script from the "Discovering the iPad interface" thread. I'll worry about PKCS12 authentication later.

The sheep game doesn't play too well, but here's a game that fully works:


```
http://91.121.199.16/1980-games/flash4/jeux-reflexion/jeux-flash/reversi.swf
```
Yeah, of course, I would pick that.  Although the first thing I tried (after the sheep) was:


```
http://www.homestarrunner.com/trogdor.swf
```
I can't get past the intro screen, but it's fun to see even that on a TiVo.

I suspect these can also be launched somehow from HME, or perhaps directly from the "Showcases" menu. We still have this one cryptic comment from a guy who never came back.

This is what I'm using for now:


----------



## moyekj (Jan 24, 2006)

Still hoping someone that is familiar with Flash can run with this.
ActionScript 2 kind of blows as a language from the little I played with it and apparently is being phased out. ActionScript 3 seems better but a similar "Hello World" swf I created using as3 via FlashDevelop didn't run on TiVo (browser worked fine). There seems to be many kinds of Flash so just figuring out what the TiVo player will or will not play may be a challenge. I guess TiVo is using "Adobe Air" whatever that is (and apparently is not going to be further developed by Adobe).

First step would be to figure out how to respond to remote control presses with eventual goal of trying out video. Really hope that annoying 1.1GB buffer limit is not in play here since that's the real killer of the non-flash HME method (which is copy rather than stream). There must be a way to stream via Flash rather than copy. I figure the upcoming revamped Netflix & YouTube HME apps being talked about in the TCF forums are most likely Flash based and use streaming.


----------



## Iluvatar (Jul 22, 2006)

moyekj said:


> First step would be to figure out how to respond to remote control presses with eventual goal of trying out video. Really hope that annoying 1.1GB buffer limit is not in play here since that's the real killer of the non-flash HME method (which is copy rather than stream). There must be a way to stream via Flash rather than copy. I figure the upcoming revamped Netflix & YouTube HME apps being talked about in the TCF forums are most likely Flash based and use streaming.


I wouldn't think that would be a problem with FFmpeg and rtmp streaming. Hulu+ is serving up flv files through rtmp (well encrypted rtmp). Would be easy to mux streams into a flv to serve up. The rest of the framework is the real work 

edit: I meant to say FFmpeg along with a FMS server. I believe there are a few opensource Python modules that could be used for the purpose.


----------



## Soapm (May 9, 2007)

moyekj said:


> Still hoping someone that is familiar with Flash can run with this..


When you said flash I thought of flashing the prom or one of the chips on the board so I guess I wouldn't be much help...


----------



## moyekj (Jan 24, 2006)

Iluvatar said:


> I wouldn't think that would be a problem with FFmpeg and rtmp streaming. Hulu+ is serving up flv files through rtmp (well encrypted rtmp). Would be easy to mux streams into a flv to serve up. The rest of the framework is the real work
> 
> edit: I meant to say FFmpeg along with a FMS server. I believe there are a few opensource Python modules that could be used for the purpose.


 That certainly sounds promising.
So far I've been unable to get any compiled AS3 code to run. Only compiled AS2 code seems to run for me so far. I actually have keyboard event listener working in AS3 code that works when running in a browser.


----------



## Iluvatar (Jul 22, 2006)

moyekj said:


> That certainly sounds promising.
> So far I've been unable to get any compiled AS3 code to run. Only compiled AS2 code seems to run for me so far. I actually have keyboard event listener working in AS3 code that works when running in a browser.


I don't profess to know anything about Flash but at one point the Copyright & Trademarks screen under System Info on the TiVo listed AS2 modules being used for its interface. I've heard they are migrating to Air and Flash Lite but I'm uncertain how that relates to the full Flash API versioning as far as feature and scripting compatibility would go.

edit...


----------



## cyphers72 (Jul 8, 2002)

I get no response at all from uiDestinationInstanceSearch. Every other command seems to work. Python script works. Auth and keys work. Have tried setting body_id to the TSN in both the header and body with no luck. The box doesn't reply at all. No error, nothing. Authentication and other keys work like Pause, etc.

I'm calling it this way from the script:

req = RpcRequest('uiDestinationInstanceSearch', uiDestinationType='flash', levelOfDetail='high', noLimit='true', bodyId='tsn:XXXXXXXXXX')

The log output looks sane. I feel like something is missing from the command. Have tried against both an Elite and a normal Premier. Anyone have maybe a raw log output from a working uiDestinationInstanceSearch that is verified against a real box?


----------



## moyekj (Jan 24, 2006)

cyphers72 said:


> I get no response at all from uiDestinationInstanceSearch. Every other command seems to work. Python script works. Auth and keys work. Have tried setting body_id to the TSN in both the header and body with no luck. The box doesn't reply at all. No error, nothing. Authentication and other keys work like Pause, etc.
> 
> I'm calling it this way from the script:
> 
> ...


 If using the python script you need to add printing of return values. i.e. After:
result = self.Read()
Add:
print result


----------



## moyekj (Jan 24, 2006)

Progress.

AS2 code to get button press keycodes:
*keyboard.as*

```
// Compile: mtasc -swf keyboard.swf -main -header 800:600:20 keyboard.as

class Sample {
   static var app:Sample;
   
   function Sample() {
      // entry point
      // Define text formatting
      var emphatic:TextFormat = new TextFormat();
      emphatic.bold = true;
      emphatic.size = 20;
           
      // creates a 'tf' TextField size 800x600 at pos 0,0
      _root.createTextField("tf",0,0,0,800,600);
      // write some text into it
      _root.tf.text = "HELLO WORLD !";
      _root.tf.setTextFormat(emphatic);
     
      Key.addListener(_root);
      _root.onKeyDown = function() {
          _root.tf.text = "Key Pressed: keyCode=" + Key.getCode();
          _root.tf.setTextFormat(emphatic);
      };
    }

   // entry point
   static function main(mc) {
      app = new Sample();
   }   
}
```
keycodes derived from above:

```
select      13
left        37
up          38
right       39
down        40
0           48
1           49
2           50
3           51
4           52
5           53
6           54
7           55
8           56
9           57
vol up      16777217
vol down    16777218
mute        16777219
chan up     16777220
chan down   16777221
record      16777222
play        16777223
pause       16777224
ff          16777226
rew         16777227
skip forw   16777228
skip back   16777229
enter       16777233

thumbs up   33554439
thumbs down 33554440
info        33554444
slow        33554462
aspect      33554485

APPLICATION EXIT KEYS
Live TV
Guide
TiVo
Clear
```
Sample AS2 code to embed a YouTube video:
*movie.as*

```
// Compile: mtasc -swf movie.swf -main -header 800:600:20 movie.as
class Sample {
   static var app:Sample;   
   function Sample() {
      _root.createEmptyMovieClip("video_mc", _root.getNextHighestDepth());
      _root.video_mc.loadMovie("http://www.youtube.com/v/b694exl_oZo");
   }

   // entry point
   static function main(mc) {
      app = new Sample();
   }   
}
```


----------



## cyphers72 (Jul 8, 2002)

Got it working, thanks.

Looks like the tunerStateEventRegister call has changed since the initial research last year. It now complains "Must specify monitoring." Anyone know what to pass for that? The error is mentioned in the old thread, but none of the samples use it so I assume this was a software change. I've tried passing "true" and "foreground" with a "monitoring" parameter but no dice.


----------



## moyekj (Jan 24, 2006)

cyphers72 said:


> Got it working, thanks.
> 
> Looks like the tunerStateEventRegister call has changed since the initial research last year. It now complains "Must specify monitoring." Anyone know what to pass for that? The error is mentioned in the old thread, but none of the samples use it so I assume this was a software change. I've tried passing "true" and "foreground" with a "monitoring" parameter but no dice.


 As defined in python script the 'monitor' parameter is type Boolean not string so should be either True or False (which in turn will set ResponseCount in header to either 'multiple' or 'single'). So in this case you should set it to True. I use this one in kmttg so I know it works.


----------



## moyekj (Jan 24, 2006)

So I take it nobody has pursued this further? My challenge to someone willing to look into it further is to get full screen FLV video via ActionScript 2. Bonus points for some basic trick play functionality included (keycodes for most TiVo remote buttons are posted above). Double bonus points for using streaming instead of loading a whole movie. One would think that would be trivial since after all Flash was designed with video in mind but I found AS2 language extremely poor and unintuitive and spent half a day searching for a way to do it and found nothing. Little wonder AS2 was abandoned in favor of AS3 but of course leave it to TiVo to apparently only support the older/crappier AS2. I knew nothing about Flash stumbling into this functionality and now I'm starting to see why Steve Jobs never endorsed it...


----------



## moyekj (Jan 24, 2006)

FYI, I did find an example of getting flv video playback via AS2 using FlashDevelop IDE from here:
http://www.flashdevelop.org/community/viewtopic.php?p=1583

Specifically the FlashDevelop project can be downloaded here:
http://flashdevelop.org/downloads/documents/VideoSample-1.0.0.zip

(Important part to note is the video object swf is compiled from xml file using "swfmill" as you apparently can't define a video object directly in AS2 for some stupid reason).

Works fine in Adobe Flash player and web browser, but on TiVo just the text shows up, not the video portion...


----------



## cyphers72 (Jul 8, 2002)

I think the mdns trace code will need to be revived. With data that is somewhat old now, the last comments were that the mdns SSL MITM trace code from arantius didn't seem to work with 1.5 yet. As it's now 1.9.1, I think some things have changed. I noticed various windowing-style behaviors that are unexplained. The Flash thing you mention sounds like one of those where you may need to tell the UI navigator where to be first.

In particular, I can't figure out how to change channels -- other than sending 4 separate key events of course. This can obviously be performed via the API and the official app does it, but the traces seem to have captured only how to navigate to a recording. Given the ability to get fresh data from the app, I think virtually any question could be resolved.


----------



## cyphers72 (Jul 8, 2002)

Got the "Spring Update" aka 20.2.1 and it now requires an SSL client-side certificate to connect. So everything that uses mindrpc is now officially and completely broken.

Will need to figure out if it actually cares what cert is used or if anything works. Worst case scenario it only takes the cert embedded into the TiVo app which means it could in principle be extracted of course.


----------



## moyekj (Jan 24, 2006)

See post #4 of this thread. I already knew about the new PKCS12 authentication and warned about it and kmttg was updated a while ago to deal with it as was the zip I posted above. If you still want working Python code then you'll have to figure out how to do PKCS12 authentication with Python. The relevant Java code with the all important password you can find here (see method createSocketFactory):
http://code.google.com/p/kmttg/source/browse/trunk/src/com/tivo/kmttg/rpc/Remote.java
zip file in post #4 has the "cdata.p12" PKCS12 client side file.

Of course none of what you are doing is really relevant to executing Flash on Series 4 units which is what this thread is about. At this point we'll likely just have to wait for the official TiVo SDK release to see if there is anything interesting there. Haven't looked at this in a while but I couldn't get AS3 code to run via this method of executing Flash, only AS2 code seems to run and I couldn't get video object working there. Most likely the official SDK will be AS3 based.


----------

