Prevue Interactive Reverse Engineering

[AriX]

I started taking a cursory look at the Prevue Interactive software the other day.

First, a complete history if you're interested:
- This software started out as a partnership between TCI cable and TV Guide (the magazine, owned by News Corp) in the mid-90s. It was called TV Guide On Screen, and also had a corresponding channel, called the TV Guide On Screen Channel, which was Windows-based and written in C++.
- At some point, TCI bought UVSG, and gave its TV Guide On Screen assets to Prevue Networks.
- Prevue discontinued the TVGOS channel and hired the programmers to work on the Prevue Channel instead. It took the TVGOS interactive guide software (which hadn't been launched in many markets), and renamed it "Prevue Interactive" (also sometimes referred to as "Prevue Navigator"). Prevue had already been working on their own interactive guide, which they then renamed "Prevue Express." Rather than being a full-featured menu system like Prevue Interactive, Express's guide was the Prevue Channel, with the bottom half overlaid with a listings grid that could be paged through manually instead of scrolling. You could also get more information about each program, etc. This site from 1997 provides a nice view of the original Prevue Interactive: http://www.bluestarmediagroup.com/tciti ... pinav.html You can also see two similar product manuals for the DCT-1000 cable box, which at the end, have pictures of the IPG - TV Guide On Screen and Prevue Interactive. It can also be seen in a manual I found lying around in my house a few years ago, which ignited my interest in Prevue in the first place: http://cl.ly/3b1j1347303d0h2w3O3j
- When UVSG bought TV Guide, they renamed Prevue Interactive to "TV Guide Interactive." However, they kept the name "Prevue Interactive" in Canadian markets for unknown reasons. A little before this, they made some changes to the look of Prevue Interactive. They added a blue background gradient, and ads. You can see very very brief examples of this in this video: http://www.youtube.com/watch?v=0OQLtFTykDg
- In 1999, TV Guide rolled out a major new release, A15, which was dubbed "Tan Guide." You can see this here: http://web.archive.org/web/200012050554 ... asp#Design
- Tan Guide is updated to A16 and then A17, adding quick menu, On Demand, and some other changes.
- TV Guide Interactive (at this point, Gemstar-TV Guide) introduces Blue guide, software version A18, with DVR features. Non-DVR boxes continue using tan guide. Blue guide is updated up to A21.
- TV Guide Interactive introduces the i-Guide with version A22. They have an online demo of this guide, and they made both Prevue-branded and TV Guide-branded versions of it. You can also see this diagram comparing features of tan and blue guide with i-Guide.
- i-Guide is licensed to Comcast through the joint venture GuideWorks.
- i-Guide 1000 is introduced, bringing an updated guide to the older, slower cable boxes and finally getting rid of Tan Guide and Blue Guide.
- Rovi acquires Gemstar-TV Guide, and lays off most of its Tulsa-based interactive developers (this may have happened earlier). It also mostly phases out the vestiges of the Prevue brand in Canada. I think Rogers Cable guides may still be Prevue-branded.
- Comcast continues to update i-Guide to add minor features, and the software is currently at version A28. Rovi continues to sell it.

Okay, so where does the reverse engineering come into this? Well, thanks to a community of people who hack cable boxes and other things, I have a software dump of TV Guide Interactive A23 from 2005. I found out that the DCT cable boxes this version is designed to run on actually use the same M68K processors that are found in the Amiga, so I decided to pop open my disassembler and see what I could find.

The disassembler had a lot of trouble analyzing the binary. In the end, I may have to analyze some of it manually, since IDA can't quite figure out what is code and what is data, and I have no way of emulating/running this software at all. Maybe at some point I'll pick up a cable box, throw this software on there, and use the JTAG debugger to figure out what's going on. But I'm not planning to invest too much time into this project in the near future. There were some interesting things - there are no references to Prevue in the code, but there are references to "General Instrument" and "TVGOS."

I'll keep you guys updated if I get anywhere, but probably if I work on reverse engineering Prevue stuff in the near future, it will be Sneak Prevue (if I can ever get a copy) or ESQ/Prevue Channel.

[nwgatwcfan]

At a quick glance of the binary file, I noticed that this dump was from a Shaw Cable DCT in Canada. I do recognize some of the text from my cable box as well.

I'm surprised they were able to get a dump of this software. I will say that on my box, the TV Guide part is a separate software that is added to the other software on the box. So, what may be a large file, may acutally be several programs in one dump.

Thanks for sharing this information. I am quite interested in this discovery.
Steven

[AriX]

At a quick glance of the binary file, I noticed that this dump was from a Shaw Cable DCT in Canada. I do recognize some of the text from my cable box as well.

Yep, that's true!

I'm surprised they were able to get a dump of this software. I will say that on my box, the TV Guide part is a separate software that is added to the other software on the box. So, what may be a large file, may acutally be several programs in one dump.

I believe you are correct. The TV Guide portion of the software starts after $AA000, I think. In order to get this firmware dump, they had to connect the JTAG interface to the processor of the DCT.

Thanks for sharing this information. I am quite interested in this discovery.

No problem - I'll keep you updated!

[JFR_SneakPrevue98]

AriX,

Quite interesting read on what the Interactive Guide is like. Over on the AVS Forum there is a thread on the Motorola DCX boxes and the majority of the thread is about the software issues. Time Warner, Cox and my Cable Company (Charter) updates their boxes whenever there may be a new release. Comcast is slow at updating their boxes and users on the forum who have a DCX3400 with Comcast experience "black" recordings. I have a DCX3400 with the software version being 78.44 - A28p0-2.0908.r-4 and firmware version 22.92. There 2 so called Easter eggs on the DCX boxes along with the DCT and DCH boxes that consumers weren't supposed to see: Diagnostics (Power Off>Ok/Select) and Info Screens (Menu twice>Setup>Cable Box Setup>Select to display (Configuration:)>Fav button). Some people hacked into the box (DCT, DCH and even DCX), to add a 1TB Hard Drive for more recording space. Up in Canada some people have an external hard drive hooked up to the DCX and there is a Time Warner Cable market in Texas who also has the same ability to hook up an external hard drive. May be what you could to is to type a Word doc (converted into a PDF) on what you came up with for the Interactive Guide.

[AriX]

AriX,

Quite interesting read on what the Interactive Guide is like. Over on the AVS Forum there is a thread on the Motorola DCX boxes and the majority of the thread is about the software issues. Time Warner, Cox and my Cable Company (Charter) updates their boxes whenever there may be a new release. Comcast is slow at updating their boxes and users on the forum who have a DCX3400 with Comcast experience "black" recordings. I have a DCX3400 with the software version being 78.44 - A28p0-2.0908.r-4 and firmware version 22.92. There 2 so called Easter eggs on the DCX boxes along with the DCT and DCH boxes that consumers weren't supposed to see: Diagnostics (Power Off>Ok/Select) and Info Screens (Menu twice>Setup>Cable Box Setup>Select to display (Configuration:)>Fav button). Some people hacked into the box (DCT, DCH and even DCX), to add a 1TB Hard Drive for more recording space. Up in Canada some people have an external hard drive hooked up to the DCX and there is a Time Warner Cable market in Texas who also has the same ability to hook up an external hard drive. May be what you could to is to type a Word doc (converted into a PDF) on what you came up with for the Interactive Guide.

Thanks for writing that stuff up - there are actually two more hidden things though! In addition to the one where you turn the box off and then quickly press the select button, you can also turn it off and quickly press the menu button to bring up a configuration screen. However, I'm not sure whether or not that those are related to TV Guide/Prevue Interactive - it may be a Motorola firmware feature.

The extra information on the configuration screen is fascinating - some of it seems to suggest that the boxes use a timeslot-based system (with 24 timeslots) just like our best friend, the UVSG satellite format. I also have heard from some of the people who worked on both the interactive software and the Amiga software that the data delivery system these boxes use (used?) is reminiscent of UVSG data, utilizing a data carousel where all of the data needed for operation is sent repeatedly in a circle. I would guess that it is somewhat faster than 2400 baud :p

The last one is a hidden feature in what's called the "MAC-G User Agent," which is a software extension to i-Guide to allow running EBIF applications. (EBIF is a specification for XML-based interactive TV apps.) Comcast's brand name for this is iTV. When in any iTV application, if you press menu three times quickly, you'll get an info screen about the application and its version. Examples of EBIF applications on Comcast: caller ID, the iTV menu, the HSN channel's interactive shopper, those overlays over advertisements trying to get you to watch something in On Demand, and some interactive voting things on certain reality/game shows.

[JFR_SneakPrevue98]

You're welcome. I think everybody knows about the power off>menu feature. On my Cable System we have 3 ways for accessing On Demand content On Demand button, typing in the On Demand channel or selecting the On Demand icon for select shows and movies. Back in 2000 I had the tan TV Guide Interactive and it had 2 buttons that weren't clickable. One button was for On Demand and the other was a Watch Previews button. I guess TV Guide modeled their Interactive Guide after Prevue Interactive. There is one major flaw about the TV Guide i-Guide is that it re-downloads when the power goes out. I wish there was a flash chip where the software lives so that during a power outage it doesn't re-download. I'd like to find some info on the ins and outs of the TV Guide i-Guide.

[AriX]

You're welcome. I think everybody knows about the power off>menu feature. On my Cable System we have 3 ways for accessing On Demand content On Demand button, typing in the On Demand channel or selecting the On Demand icon for select shows and movies. Back in 2000 I had the tan TV Guide Interactive and it had 2 buttons that weren't clickable. One button was for On Demand and the other was a Watch Previews button. I guess TV Guide modeled their Interactive Guide after Prevue Interactive. There is one major flaw about the TV Guide i-Guide is that it re-downloads when the power goes out. I wish there was a flash chip where the software lives so that during a power outage it doesn't re-download. I'd like to find some info on the ins and outs of the TV Guide i-Guide.

TV Guide didn't really "model" their guide after Prevue Interactive... TV Guide Interactive is Prevue Interactive. Just a newer version. The problem where the software needs to be redownloaded is primarily Motorola's fault, not i-Guide.

And lastly, there really is no place to find info "on the ins and outs" of i-Guide. It's a proprietary system that no one knows much about other than the programmers who work on it. Which is why I want to reverse engineer it

[JFR_SneakPrevue98]

I am just wondering if there is an Operating System that Prevue Interactive (now TV Guide i-Guide), runs on. There is or was another Interactive Guide called MOXI (by Diego now called Arris), that runs on a form of Linux. With the MOXI software and the OS lived on the 80 GB hard drive in which made the recording space less than what is stated on the specs sheet for the MOXI DVR Box. I believe on the Motorola DVR and non-DVR Boxes there should be a place to put a flash card where the software and OS could live.

[AriX]

I am just wondering if there is an Operating System that Prevue Interactive (now TV Guide i-Guide), runs on. There is or was another Interactive Guide called MOXI (by Diego now called Arris), that runs on a form of Linux. With the MOXI software and the OS lived on the 80 GB hard drive in which made the recording space less than what is stated on the specs sheet for the MOXI DVR Box. I believe on the Motorola DVR and non-DVR Boxes there should be a place to put a flash card where the software and OS could live.

Quick note - this software is not called "TV Guide i-Guide" - the current version is called either "i-Guide" or "GuideWorks"; the former version is called "TV Guide Interactive," and the one before that is "Prevue Interactive."

Anyway, the software doesn't run on an "operating system" the way our computers do -- and it's certainly not Linux-based. Rather, it's a large program built on Motorola's DCT APIs, and it's somewhat modular (for adding stuff like interactive content and On Demand). The Motorola firmware is stored in Flash memory somewhere inside the box, and i-Guide is simply stored in RAM, since it is redownloaded every time the box needs to reset, and I don't believe the boxes are capable of booting from an external disk.

[AriX]

Sad news in the past few months for what's left of Prevue Interactive... the platform is soon to be replaced by what Rovi calls "TotalGuide" and what Comcast calls "X1." That said, the new guide looks a LOT nicer than the current i-Guide
http://files.shareholder.com/downloads/ ... tation.pdf
http://www.rovicorp.com/webdocuments/pr ... Literature
Interestingly, Rovi notes that the new guide will be run "alongside i-Guide to ease consumer adoption." I wonder what that will look like.

(Rovi still sells i-Guide here, and it was, at one point, sold by Prevue Interactive.)