What is this IR-type-y board doing inside of my set-top-box? - Page 1
Forum section: electronics / general

author: CherryDT
author_rank: Contributor
timestamp: February 02, 2021, 01:21:11 pm
content: Does anyone have a clue what this PCB is doing in my set-top-box (behind half-transparent plastic)? It features an FPGA, a shielded IR receiver and 4 LEDs (probably IR as well). - Note that there is another IR receiver elsewhere, next to the display, so I don't think this board is responsible for receiving remote control signals (and also why would it need LEDs then). 🤔Thank you--EDIT: The device is white-labelled and marketed as "A1 Mediabox Recorder" but it seems in reality it's a TLA-5720SWFX by Advanced Digital Broadcast (sorry I should have mentioned that from the start). I wasn't able to find much information about it online.Also, some people got a weird alert about my website which hosts this image (the original link wasthis), so in case you trust Dropbox more, use this link:https://www.dropbox.com/s/tdznqb2uwg20cm9/2020-10-04%2019.06.46.jpg?dl=0

author: hexreader
author_rank: Frequent Contributor
timestamp: February 02, 2021, 02:18:50 pm
content: Wild guess only....Is it for detecting gestures - like X-Box does?Control your box just by moving your hands.X box uses IR emitters like that, but the receiver is an IR sensitive camera, not IR receiver.

author: Benta
author_rank: Super Contributor
timestamp: February 02, 2021, 05:06:38 pm
content: Could be for viewer presence detection. Not commonly used in Europe, but very common in the US for the Nielsen ratings.

author: ConKbot
author_rank: Super Contributor
timestamp: February 03, 2021, 09:30:27 pm
content: Repeater so you can control your TV with the set top box remote without having to program the remote? If you dump enough IR out forwards, the reflection/scattering on the far wall should be enough to signal the TV?

author: Benta
author_rank: Super Contributor
timestamp: February 03, 2021, 10:42:52 pm
content: Quote from: ConKbot on February 03, 2021, 09:30:27 pmWhy would that function need a receiver?

author: thinkfat
author_rank: Unknown
timestamp: February 03, 2021, 10:50:44 pm
content: Existence of a Spartan FPGA suggests there's some signal processing going on. Maybe each of the LEDs is modulated differently and you can infer an object position from the reflected signal returning to the single receiver?

author: NiHaoMike
author_rank: Super Contributor
timestamp: February 03, 2021, 11:09:15 pm
content: Could it be a transceiver for IR headsets?

author: pardo-bsso
author_rank: Frequent Contributor
timestamp: February 04, 2021, 01:43:54 am
content: Do you have more data on the device (maker, model...)Perhaps the same or a similar one is on the fcc database and that should have details about it's internal operation.

author: tom66
author_rank: Super Contributor
timestamp: February 04, 2021, 09:07:43 am
content: Perhaps it's used to estimate the size of the room - the light pulses are transmitted and the return time is measured. This is then used to ... do market research, or perhaps less nefariously alter the surround sound settings?It is a rather peculiar board and the FPGA on there suggests it was relatively low volume which does align more with the idea of market research / Nielsen ratings.

author: Ranayna
author_rank: Super Contributor
timestamp: February 04, 2021, 11:29:17 am
content: Weren't there some shenanigans going on, regarding the number of people watching something?So that the "Rights Holders" can stop a stream when too many people are present in a room? Or ask you to pay more money?Maybe that is some early implementation of something like that. Please post the model of the set top box.

author: ConKbot
author_rank: Super Contributor
timestamp: February 04, 2021, 12:16:21 pm
content: Quote from: Benta on February 03, 2021, 10:42:52 pmRegular IR remote for the set top box, setup to have spacing between each "burst" of the code for the button you're pushing, that includes power, volume up/down and tv power buttons. You configure what TV you have in the set top box menu, so volume and tv power on button trigger the set top box to transmit the correct codes for volume up/down/power for the TV between the bursts of the incoming code.I know HDMI has CEC to handle this kind of functionality, but I haven't seen that working very well between different brands of devices. But then again, I haven't bought a tV in 8-9 years, so maybe CEC over HDMI has improved.

author: PlainName
author_rank: Super Contributor
timestamp: February 04, 2021, 12:20:40 pm
content: Have to warn y'all that Bitdefender is popping up on this page with:QuoteOP pops up here out of the blue, dodgy web link, uh-huh...

author: Syntax Error
author_rank: Frequent Contributor
timestamp: February 04, 2021, 12:59:57 pm
content: Same suspicious activity noted herePossible compro domain?SSL certificate does not verify.Lock & remove post <

author: tom66
author_rank: Super Contributor
timestamp: February 04, 2021, 05:09:07 pm
content: It's a file sharing site, if it didn't have some kind of virus uploaded at some point I'd be surprised!

author: Ranayna
author_rank: Super Contributor
timestamp: February 05, 2021, 11:06:49 am
content: Well, if it *is* spam, it is exceptionally well tailored spam.I also klicked on the embedded image, expecting it to be embedded from imgur. Only when i saw the loading animation i closed the new tab before it finished loading. Then i noticed the URL...That, combined with the username, the fact that the OP is a new account and has not posted again makes it quite likely to really be spam...

author: thinkfat
author_rank: Unknown
timestamp: February 05, 2021, 11:18:03 am
content: Goes to show that social engineering also works with the technically savvy. You just need a different bait.

author: Syntax Error
author_rank: Frequent Contributor
timestamp: February 05, 2021, 03:18:39 pm
content: Possibly, I suspect the server, or some DNS shadow, runs a suspicious http-request script that's looking for certain combinations of user-agent, referer and cookies.A hypothetical attack may go like this: First browser http request, and the server responds with an image, but sets the cache expiry to one minute. After a minute, the user clicks on the image and, as the browser no longer has a valid cached copy, raises a second http request with the server. Server knows the IP has already been seen, so it checks if the user agent matches a known vulnerability and if so, sends a malware payload. Otherwise, the server returns the same image but, with no cache expiry; hence so no-one else notices. This is only a theoretical attack, which I have not created in a lab condition.On a forensic note, in linux use 'wget' to simulate different browser types. E.g. a Chrome browser with different OS versions, or Internet Explorer with a variable referer strings. Thus a remote server thinks it's dealing with IE when it's not. Record returned responses with 'pcap' and use Wireshark to identify any dubious traffic. Alternatively, use 'netcat' or 'nc' to the same effect.

author: CherryDT
author_rank: Contributor
timestamp: February 09, 2021, 08:52:43 am
content: This is my own filesharing site, targeted at a certain community mostly (RPG Maker) and used by just a handful of people who prefer a trustworthy site by a guy they know personally over companies like Dropbox or Google nowadays. Before I gave it its own domain a few months ago and rebuilt it with a bit more modern technologies, the domain was share.cherrytree.at and if you google that you'll see it's been around for ages and used in many forum posts in that community.I don't see what risk you are getting reported there, it's supposed to be a "like in the old times" site which doesn't use any trackers or analytics or anything like that, there is no third party code loaded even. :| And it's running Caddy in a version which I compiled myself (which gets the SSL certificate from LetsEncrypt (R3)) and a pretty basic node.js application on top, with the frontend written with Svelte. Do you have any more details about what is supposedly wrong about my page? O_o And you mentioned SSL doesn't verify - but it sure does, I never encountered any issues with it - do you have a screenshot of what's shown as a problem with the certificate? It should deliver a certificate by R3. Domain, DNS and the cloud server itself (which is a container) are hosted by the German webhosting company Dogado which I use and trust for many years. I'm at a loss now...DNS is supposed to resolve to 89.22.111.7 and 2a02:2b80:1:0:5652::693 by the way. And I ran a check in a DNS propagation checker now and I didn't see any country in which it's resolved to anything else.Also @Syntax Error the link and the image aren't the same URL, my site has a feature exactly for forum posts like this, where it generates a nice (url)(img)(/url) combination for you which delivers a thumbnail as image and links to the page with the full-size image. (Why not linking to the image directly? Well in this case here it doesn't matter much but in general it's designed to load the page because it contains metadata such as the author and the upload date, and the author can also optinally set a title and a description which would be shown on the page as well.)Anyway I submitted a false positive report with Bitdefender now, and I swapped the link in the post for a Dropbox link (which I personally trust less than my own site, but I understand it'll be different for you)...---Anyway thanks for your feedback, these are all pretty interesting possibilities. The device did have a way to control the TV's on/off and volume functions but I thought this was done through the remote control itself. If there was any gesture thing, it wasn't used with this software version, that's why I was very surprised when I found this weird board. The device is white-labelled and marketed as "A1 Mediabox Recorder" but it seems in reality it's a TLA-5720SWFX by Advanced Digital Broadcast (sorry I should have mentioned that from the start). I wasn't able to find much information about it online.I was originally taking it apart because I wanted to see if I can access my recordings on the harddisk of the device, since it appears that after I cancelled my contract, I lost access to my recordings too (I hate this sort of thing). But I failed with that as well because the harddisk, once connected to the computer via SATA, didn't even register at all, and I couldn't figure out why.---QuoteActually I had an account since June 2016 and I still have the welcome email but for some reason the account seems to have been deleted because I had to create a new one (and I was able to do so with the same username). And I'm a Patreon supporter, but I don't know how to get the "supporter" title (if that's even related) - but I also asked about the uRuler (which was written on Patreon I'd get) many times on different channels over the years and never got an answer, let alone the uRuler itself; and now this thread makes me look like a spammer, and by the way I'm writing this edit for the 2nd time because previously I was dropped to an empty "reply" page instead of getting my edit saved - so it seems the EEVBlog universe is conspiring against me maybe- Anyway, sorry, I could have introduced myself better. I'm a 28yo software developer from Austria who is also into tinkering with electronics and I've been enjoying the EEVBlog videos for many years.

author: Syntax Error
author_rank: Frequent Contributor
timestamp: February 09, 2021, 10:08:42 am
content: One possibly, DNS cache poisoning?https://www.cloudflare.com/learning/dns/dns-cache-poisoning/

author: CherryDT
author_rank: Contributor
timestamp: February 09, 2021, 10:12:57 am
content: Yes but I don't understand who would be the bad actor then? Dogado? (Which is unlikely unless they got hacked themselves, I guess.) Unfortunately I didn't get any actual evidence (bad IP plus info which server resolved it) so far so I don't even know where to look or whom to report it to.Normally I understand DNS cache poisioning to happen in a local network with the possibility to inject some malicious UDP packages, but unless both you and dunkemhigh are on the same network (are you?), that's not a logical explanation for both of you seeing an issue. Do you remember what error you got for the SSL certificate, was it a wrong common name, and do you happen to remember which?EDIT: Hm actually I'm starting to get another thought. You said you saw the same suspicious activity, were you referring to a BitDefender alert as well? In that case, the SSL error could have an even simpler explanation - Bitdefender would intercept the request and return its own warning page probably, which however won't have a valid certificate because it can't impersonate cherryshare.at. I get the same with Malwarebytes - if the web protection intercepts a request, I see a Malwarebytes page if it was HTTP, but I get an SSL error if it was HTTPS. In that case the only issue would be a false positive of BitDefender (for whatever reason), and the SSL issue would be just a symptom of that... Is that possible?

author: tom66
author_rank: Super Contributor
timestamp: February 09, 2021, 01:59:20 pm
content: Any info on the rest of the PCB, perhaps a label as to what it might connect to?Pictures of the whole set-top box internals including the main board ... I used to work for a company that 'made' these, actually most of them were OEMs/3rd parties and we did our software for them, so I might recognise it.

author: CherryDT
author_rank: Contributor
timestamp: February 09, 2021, 02:23:20 pm
content: Full assembly:https://www.dropbox.com/s/4h5v4tkugyq41wu/2021-02-09%2015.17.19.jpg?dl=0Back side of the mystery board:https://www.dropbox.com/s/4h5v4tkugyq41wu/2021-02-09%2015.17.19.jpg?dl=0Main board:https://www.dropbox.com/s/xnvaykt8y193fi8/2021-02-09%2015.20.51.jpg?dl=0Connector (it just says CN15):https://www.dropbox.com/s/xnvaykt8y193fi8/2021-02-09%2015.20.51.jpg?dl=0Area of the board around the connector (from the other side of the shield):https://www.dropbox.com/s/63pjiluvgy25eio/2021-02-09%2015.21.36.jpg?dl=0Also, when you disconnect most of the stuff from the main board incl. the harddisk and attempt to start it, you get a screen that says DIGITAL RECEIVER LOADER - ADB 1.2.60F-A03-0X71DD L.1 B.7102.9206 - PLEASE WAIT - SOFTWARE UPGRADE which after a while just reboots again. Maybe this identifier tells you something... Thank you!

author: AndyC_772
author_rank: Super Contributor
timestamp: February 09, 2021, 03:06:55 pm
content: I'd start with a super low tech approach to seeing what it's doing.Cover it with duct tape and see what, if anything, stops working.

author: CherryDT
author_rank: Contributor
timestamp: February 09, 2021, 03:08:24 pm
content: That's a cool idea! Unfortunately I can't really do that because the device is no longer operational after I cancelled my TV contract. (I can't even access my recordings on the harddisk, which was the reason I took it apart in the first place, but unfortunately I didn't succeed with that either.)

author: tom66
author_rank: Super Contributor
timestamp: February 09, 2021, 03:58:59 pm
content: Definitely not one I recognise.The SmarDTV chip is made by a prior employer, but IIRC it's just a customised Philips crypto MCU + card reader device with some Kudelski cryptography secrets on it.

author: CherryDT
author_rank: Contributor
timestamp: February 09, 2021, 04:58:04 pm
content: OK, thanks for taking a look anyway!I realized that the marking on the mystery board says PCB-L023C-VOCO-B while the main board says PCB-L023C-MAIN-C.I guess "VOCO" could be a clue to what it is then, but I don't know what that means and Google didn't enlighten me either.

author: Syntax Error
author_rank: Frequent Contributor
timestamp: February 09, 2021, 09:43:17 pm
content: @CherryDT - Sorry you had a rough introduction to the forum. There was certainly something strange happening, but all seems to be okay now. Maybe your web host had an issue with their DNS. You can post images onto the eevBlogWith regard to your mystery board; I note the four LEDs have are associated with large low-value SMD resistors, which suggests a constant current control? Put another way, the EE went to a lot of trouble to ensure those four LED's produce a constant Lux. Which is what might be expected of measurement euipment.I too wonder if this is a gesture control board. Four LEDs can be used to encode, up, down, left and right, even with a simple light sensitive diode. Can the LED's shine through the plastic front cover?Or maybe it's the CIA

author: CherryDT
author_rank: Contributor
timestamp: February 09, 2021, 10:00:47 pm
content: Yes, the front looks black but it's actually reddish and semi-translucent, and IR passes through (the regular remote control signal does as well).I have to say, I haven't heard of gesture control in such TV boxes before (and certainly the software on this one didn't make use of it) but it sounds like the most logical explanation for the moment - I just wonder why the board was included then, given that there do appear to be different hardware versions of this box from the manufacturer's side (based on the unpopulated spots and the empty "Wi-Fi" area on the board), so I guess it would have been cheaper for them not to include it if it's not even used...

author: tom66
author_rank: Super Contributor
timestamp: February 09, 2021, 10:52:51 pm
content: Asked some friends, one thought would be to count the number of people, by estimating movement, more movement = more people.It wouldn't then block the user, but it would trigger an investigation at that address - if the device is being used to watch sports in a pub / bar, they want the large revenue from the owner, not the 40 euros per month subscription.In the UK, some pubs pay upwards of £10,000 per month to licence the sports programmes, it's a rip off. And one supplier, was still asking for the fee to be paid during Covid lockdown.

author: CherryDT
author_rank: Contributor
timestamp: February 09, 2021, 11:00:37 pm
content: Wow. I wonder how much of that data is actually transmitted to them and logged. I find it slightly creepy to have a device in (in this case) my bedroom with the capability to record a detailed log of certain... activities.Which makes me wonder how this is even effective - one could just put some sticky tape over the sensor. You might expect that someone would then also investigate since there is no data at all, on the other hand I don't see how they would be allowed to check anything at all (they can't just demand entry into somebody's apartment) and I actually had the box mounted in an unconventional position in which it couldn't pick up anything anyway probably...

author: amyk
author_rank: Super Contributor
timestamp: February 10, 2021, 01:11:30 am
content: The discovery you've made is indeed disturbing.Now I wonder what else may contain hidden surveillance devices from the factory...As the old saying goes, "In Soviet Russia, TV watches you"?