Saturday, 26 November 2011

Analysing DVB MHP application using DSM-CC analyser

I was studying some DVB-T services with DVBStreamExplorer. I noticed that on 546 MHz MUX some services were carrying Multimedia Home Platform (MHP) applications. I decided to study MHP application further with DSM-CC analyser in DVBStreamExplorer. In this exercise I shall only be using DVB Transport Stream Monitor. From that I will acquire both PSI/SI and DSM-CC information.
Image below show stream details for one of the services in MUX, LA7. Besides the common video and audio streams the presence of MHP application can also be seen here. In the stream list references to Application Information Table (AIT) and DSM-CC object carousels can be found. For instance one AIT can be found on PID 0x1ba8 (7080). An DSM-CC Object Carousel can be found on PID 0x1ba9 (7081).



Below can be seen the content of an AIT. That contains various information about the application. That covers such information as application name, transport protocol, initial Java class of application and more.


Next step is to look into the DSM-CC carousel containing the application data. Image below shows that three DSM-CC carousel streams were found. Select the streams so that DVBStreamExplorer DSM-CC analyser will start collecting DSI, DII and DDB sections. These sections will be shown fully decoded on DSM-CC sections tab.


Once all DSI, DII and DDB sections for a carousel have been acquired the data carousels can be decoded. Image below shows raw data of carousel modules found. The object carousel will be decoded from these modules.

Image below shows the decoded object carousel. It shows part of the file directory structure of the application. it also shows the binary content of one of the Java class files that is part of the application.


With DSM-CC analyser in DVBStreamExplorer there is the option to save entire carousel on local file system. After doing so you can then launch your preferred Java decompiler and have closer look at the code behind MHP application. I will leave this as an exercise for the reader.

Wednesday, 9 November 2011

Analysing DVB STB software update using DSM-CC analyser

I was going through the list of MT DTT services on http://jensvaaben.com/.
Two services caught my attention.
"Handan Software Update" and "Intek Software Update".
The service names strongly suggest that these services are carrying software updates for set-top box'es (STB). That would most likely be the set-top box'es offered by GO.



I decided to examine these services further with DVBStreamExplorer. I started by having a look at PSI/SI information for one of the services. I chose to have a closer look at "Handan Software Update". I launched DVBStreamExplorer and tuned on 754 MHz MUX which is carrying the update services. There are two options to retrieve PSI/SI information with DVBStreamExplorer. Either use the PSI/SI/PSIP -> DVB PSI/SI scanning -> current MUX. This will take a snapshot of PSI/SI information currently applicable for stream. It is also possible to use Transport Stream Monitor. This feature will monitor stream continiously. Any changes in stream will be reflected immidiately in UI.
I decided to use PSI/SI/PSIP -> DVB PSI/SI scanning -> current MUX feature. This gave me stream information like below.




The service contain one stream of type 0x0B ISO/IEC 13818-6 type B. The stream is carried on PID 0x0bb8.
This is a good candidate for a stream type carrying a software update. ISO/IEC 13818-6 type B means that it contains DSM-CC data carousel.
So the next step is to examine the service even further from a DSM-CC perspective.
DVBStreamExplorer has two options to analyse DSM-CC. Either use the standalone 'DSMCC Analyzing  (DVB)' function. Or use the DSM-CC analyser which is part of 'Transport Stream Monitor' function. Using DSMCC analyser in 'Transport Stream Monitor' has the advantage that you can browse other stream information while DSM-CC analyser is working. Simply navigate through the tabs in 'Transport Stream Monitor'.
After starting scan in 'Transport Stream Monitor' wait a few seconds. Then select the update service in service selector in top part of 'Transport Stream Monitor' window. Then select 'DSMCC' tab. By now it should have found one or more PID streams which are good candidates to carry DSMCC data. Select one or more streams to start analysing.
One disadvantage of DSM-CC analyser in  'Transport Stream Monitor' is that if a PID stream is not recognized as one carrying DSM-CC then it's not possible to analyse that PID stream. With standalone DSM-CC analyser any arbitrary PID stream can be scanned for DSM-CC carousel.


Another difference between the two DSMCC analysers in DVBStreamExplorer is that in 'Transport Stream Monitor' you can start examining DSMCC sections (DSI, DII and DDB) as they arrive. In standalone DSMCC analyser you have to wait until all DSMCC sections have been found before you can start examining content.


In screenshot above is shown part of Download Info Indication (DII) message for the Handan update service. It contains one module. The module info node shows various properties for the module. I.e. ModuleID 0x001c, moduleSize 690039 etc. There is also the moduleInfo block. In reality this is a descriptor loop. Unfortunately these descriptors are not decoded in current version of DVBStreamExplorer. Hopefully descriptor decoding will be added as a feature in a future release of DVBStreamExplorer. But after brief decoding by hand it can be seen that descriptor loop contains type descriptor (tag 0x01), CRC32   descriptor (tag 0x05) and compressed_module descriptor (tag 0x09).

We can now go to 'Data Carousel' tab to see the modules found. Another advantage of DSMCC analyser in  'Transport Stream Monitor' is that it provides a binary/ASCII view of the content of the modules found.


Both DSMCC analysers in DVBStreamExplorer have the ability to save the data carousel modules to disk. That can be useful if you want to examine the module further offline with other tools.
This concludes the brief introduction on how to analyse DSM-CC carousels with DVBStreamExplorer.

Saturday, 22 October 2011

Updating jensvaaben.com with DTV data

Jens Vaaben's homepage currently has following lists of DTV (Digital television) services.
  • 'MT, DTT', list of DTV services that can be received in Malta with DVB-T receiver.
  • 'Intelsat 707, Thor 2,3', list of DTV services that can be received in Malta with DVB-S/S2 receiver.
In this post I will explain how these lists are produced.
The raw data is captured with following hardware and software
After launching DVBStreamExplorer a connected device is selected. DVBStreamExplorer needs to be configured with MUX list to scan. It is beyond the scope of the this post to explain this here. Instead I will refer you to DVBStreamExplorer userguide for more details.

Use the function 'Multiple DVB-S MUX scanning' in DVBStreamExplorer to scan all MUX'es in a DVB-S network.
Use the function 'Multiple DVB-T MUX scanning' in DVBStreamExplorer to scan all MUX'es in a DVB-T network.
After scanning all MUX'es you'll end up with all raw PSI/SI data as shown below.



You can also switch to service view like shown below. This is is more user friendly presentation of the service information.



After scanning all MUX'es the PSI/SI service information is exported to CSV file.
An example of exported DVB.T CSV file can be downloaded here.
An example of exported DVB-S CSV file can be downloaded here.

Finally the CSV is uploaded to live server using a small home made utility.


The list is now ready to be shown at Jens Vaaben's homepage.