Inside the IceTV Skippa

In which I tell my tale of woe in buying a DVR from a defunct company and pulling it to bits in revenge.

(Full disclosure: I worked on the TiVo launch in Australia during 2008/9)

Background

I've been getting the creeping feeling that the Australian TiVo service is not long for this world. Not that I've heard anything concrete, just the age of the service and the fact it's no-longer being sold/marketed any more means there's no financial reason to keep it going any more. Then local competitors IceTV announced a new DVR with free-for-life guide-data and a new automatic ad-skipping feature. The ad-skipping was an initial free-trial with a subscription option afterwards. I didn't care because I'm used to simply fast-forwarding ad-blocks pretty-certain that there would be an unwinnable cat-and-mouse game with the broadcasters trying to fool/fix the auto-skip feature. So my Skippa arrived and I plugged it in and tried it out... Hoo boy! What an awful interface! Say what you will abut TiVo, it still has the best DVR interface out there. And as expected, the auto ad-skip feature was so unreliable it was not worth using. That was the first time I used my Skippa... Before I could have a second go, IceTV had a payment dispute with their fulfillment agency and went bankrupt immediately, terminating all service. Bummer. Eventually the shell of IceTV was resurrected with the old "Pay as you go" guide-data service, but I had no liking for that (It costs $8/mo for the IceTV guide service but it costs $9/mo for basic Netflix). So I got a rare electronic doorstop, yay for me.

What to do with it?

I'm fairly sure this would be some kind of Linux-based system and if the hardware-security's anything like the UI quality, it might be possible to load something more "malleable" onto it. The first step down this path it to crack it open and see what parts (and potential in-roads to the OS) were in the box

 Three self-tapping screws and a bit of finagling to get the top cover off. Pretty standard amount of free space in the box.

 Well lookee here! There's a main board with power, I/O and video outputs along the back edge. Theres some kind of CPU shoddily glued under a passive heatsink in the middle (I'd guess it's an ARM of some sort). There's the usual power/data connectors leading to a 3.75" 1TB hard drive. On the right is a "sibling board" containing the video tuner. At the front of the case is a display (Looks like it's driven by discrete lines, possibly GPIO from the CPU). To round it all out, there's a completely "pro looking" external USB WiFi dongle glued into a daughter board at the front of the case and connecting a USB header on the main board and an external antenna at the back of the case.
Most usefully there's a UART serial port just to the right of the CPU (This will get some attention when I get to look further at this project).

 The SATA lead has a retention clip, but the main board doesn't look like it has a tab for that, so it's also glued-in for good measure.

 I think the two dram chips are 4G DDR3 giving 8G of ram (Not too shabby!) The chip just below the CPU is almost certainly a flash-disk of some sort, but I couldn't get enough of the QC sticker off to be able to read the label on it (Also ran out of time).

The 1TB WD hard drive is not to be sneezed at either!.

Conclusion

So there you have it (So far)! I can't say I'm all that surprised at how slap-dash some of the construction is (External USB-WiFi inside and how much stuff is glued in place), but I'm not super-impressed by it either. Net time I get a chance to work on this I'll aim to:

• Identify the flash chip
• explore/image the hard drive
• try talking to the serial port (Both at boot and while running)
• Try getting "into" it.

Update #1:

So I investigated the serial port and noticed it only has a 3.3v line associated with it, so I expect a 5v UART wont work. I have a 1.8V UART that when connected at 115200 does indeed yield the boot console output. The Skippa box does not respond to any key input on the console, which could be because the 1.8v input is too low, but more likely it just doesn't have anything listening on the port.

The boot-sequence is available on PasteBin

Things that stand-out:

• It's a Broadcom BCM74290010
• It has a BMIPS5000 dual-core processor
• All the OS seems to be on the flash drive and is signed (Hardly a surprise)
• Seems to be ODM-ed by the South African company Altech UEC