Replay	HttpUtilsShellHack
	Home | Changes | Index | Search | Go

HttpUtilsShellHack

Warning

Risks

• If something goes wrong with the patch, you could disable your ReplayTV entirely.
• Even if something goes right, running shell commands is dangerous in and of itself, since they aren't intended for customer use and may have bugs or dangerous-but-intended behavior.
• The functionality exposed by this hack will be exposed on all HTTP ports, including the one normally used for InternetVideoSharing. If you use this patch, you should either choose your own name for the command, or disable the IVS port.

Version

Effect

That is, after making this change, the request http://192.168.117.3/httputils-sendciomessage?cmd=vsdemo runs the video scaling demonstration.

As mentioned in the HttpUtils page, it appears the response was intended to be a string like "Executed ..., result was ####". In fact, the response is empty. This may indicate that the string is being written to an incorrect memory location, which would lead to crashes in the best case. The output of the shell command itself isn't returned, and doesn't appear to be otherwise available.

The send-a-remote-command purpose of sendciomessage is thus disabled; the same results can be achieved by requesting http://192.168.117.3/httputils-sendciomessage?cmd=IRMTS to load the IRMTS module, which includes an rmt command; it can be used by requestion something like http://192.168.117.3/httputils-sendciomessage?cmd="rmt%20191".

the Change

• Change offset 0x2e70 from 0x64c62bec to 0x64c62ae0.
• At offset 0x47a8, change the string sendciomessage to something else the same length or shorter; choose your own name, and NUL terminate it if it's shorter than sendciomessage.

Open Questions

• is there a way in this shell to redirect output to a file, to read with HTTPFS?

Notes

192.168.117.3 is an arbitrary address being used in these examples. Substitute the IP address of your ReplayTV.

-- ToddLarason - 06 Apr 2002