BT Vision Box Hidden Menus

[VisionUser]

I switched on my Philips DIT9719 BT Vision box the other day and the menu had changed - to a secret hidden menu. The Recordings menu had dissappeared, but new menu items had come up such as:

- Demo
- Extras
- XHTML Test
- http://172.29.50.50/ajax.html
- http://172.29.50.50/mosaic.html
- CSS Acid Test
- Ajax test
- Mr Youtube
- Static Weather
- Photos and Music
- Videos
- Static Media
- Launch Application
- MediaStream PiP test
- Mediaroom services
- Client AV Storefront
- WMS Seamonkey test
- Personal media settings
- Enable playback from home network

There was an option for browsing photos and videos on the local network, it said a PC with Windows Media Player 11 was required.

There was no TV Channels, just a black screen. Pressing the "i" info button on the remote control caused the box to reboot and it rebooted back to the normal menu. I can't get back into this hidden menu.

I don't know why this hidden menu came up. Was it just a bug in the BT Vision box, or is there a secret key combination you can type into the remote control to bring it up? Or do you have to press certain buttons on the box whilst turning it on? I have read in another thread of secret key codes that bring up diagnostic text, but what is the way to bring back this secret menu? I need to get back into this secret menu!!! Has anyone else accessed this secret menu?

The Ajax test is interesting, Windows CE v5 apparently has a JPG/Gif exploit for it. If you could use the Ajax test to load a specially crafted JPG/Gif, then you could load custom code onto the BT Vision box without the need for any soldering!

Screenshots of the hidden menus are attatched

[doobleshaft]

Interesting....

I lose my pretty poor BT Broadband in a few days time and so will lose this BT Vision Box too.

It could be interesting to find all the relevant info on each version of the boxes and collate it.

Questions I can think of which I need to research are:-

Dependent on whether my box is model that can be modded, which ATMEGA chip is the best one to use? There are a few and it looks like Arduino v3 may be a good way to work on them. USB programmers have been found too...

How do we get this hidden menu? This information does look like it may be a way to access useful features and has given some useful info but I'm not convinced a modified JPG/GIF will do it. Perhaps I'm wrong there though.

What software is available that anyone has been able to get to use on the box? For example has anyone got XBMC to work or are we as suggested on one thread better off sticking with Win CE?

It could be time for a new thread which brings the latest research with latest info together as most of the threads I've seen have been 2-3 years old. Once I lose the service I'll be happy to start modding it.

[VisionUser]

I found out how to get back into the hidden menu. Now I can enter the hidden menu at will!

In order to enter the secret menu, you must disrupt the boot process by either:
1) Removing the ethernet cable halfway though bootup
2) Blocking the box from loading certain URLs during bootup with a firewall/web filtering software etc.

The URL's to block (might not need to block them all):
sg05clgv.nevis.btopenworld.com/dvrV2/DVRScheduler.asmx
sg05clgv.nevis.btopenworld.com/ListingsClientDataDelivery/PackedListingsForClient/
sg05clgv.nevis.btopenworld.com/clientsms/Purchase.asmx
sg05clgv.nevis.btopenworld.com/clientsms/GetGroupGrantedKeys.ashx
sg05clgv.nevis.btopenworld.com/MDWS/MediaDiscovery.asmx
/clientuserstore/UserStore.asmx <--- This might be the only one you really need to block
/MDWS/MediaDiscovery.asmx
/vodCatalogWS/catalog.asmx


If you block those URLs, then the box will get stuck on the grey bootup screen.
- Then put it into standby, then take it out of standby
- The screen should now be either black, or asking you to enter a 4 digit pin code (depending on which urls you block)
- Press the main menu button, and now the secret menu will appear!

I think the "secret menu" is actually the default menu on the box that happens before it loads "the client user store" and if you block the user store, then it goes to the "secret menu" by default.

Inside the secret menu, you can turn on the DLNA/upnp client or use it's built in web browser. With some dns spoofing, you can get it to load any web page you want as long as it is valid xhtml.

The DLNA client says it wants to connect to Windows Media Player 11, but I successfully got it to connect to PS3 Media Server using the Xbox 360 profile.

Quite annoying to discover the silver box has a DLNA client all along but I didn't find out until now. And getting into the secret menu turned out to be quite easy.