Poking around the outside of Time-Warner's set-top box
Anyway, I got thinking about what was in the box itself. I've seennit reboot and noticed that it has both warm and cold. I'venoccasionally seen it screw up, dropping frames or audio and even locknup. The form factor suggested that it was built around embeddedncommodity chips with a MIPS or StrongARM CPU.
I've met cable installers and figured that if I were designing suchna beast I would include a simple operator interface accessible fromnthe screen. I spent some time punching in unlisted channels (it seemednlikely that there were ones not on the interactive guide) and foundnthat there are two #1999 and #996 which are a control panel and ansystem summary (I also found that there is a silent video feed fromnwhat looks like an apartment building lobby surveilance camera). Itnseems that the box has both analog and digital connections and runs onnan private IP network in the 10.0.0.0/8 range. The MAC for the box isnfrom the range assigned to Scientific-Atlanta Arcodan of Denmarkn(00:01:a6), which isn't particularly useful given that the box isnclearly marked as theirs. Poking around I found it has 7.5MB RAM freenand about 4MB taken by a framebuffer. The diagnostics register thenpresence of a full collection of ports: serial (probably the IR),nscsi, usb, ethernet and a card slot. With the exception of the cardnslot and usb, these ports are not externally exposed. It keeps basicnstats about uptime, retries, failures and some very limited data onnpurchases but a fairly large amount on when and how many ads are seennon the PPV and MOD channels.
A little searching around the internet turned up <anhref="http://184.108.40.206/search?q=cache:dvbj4FESoRUJ:www.sciatl.com/customers/subscriber_pdfs/738942.pdf+scientific+atlanta+explorer+2100+cpu&hl=en&ie=UTF-8”>documentationnfrom the manufacturer. The Scientific Atlanta Explorer 2100 box isnbased on a 130MHz RISC (turns out it's MIPS) with a board that comesnequipped with 16MB of RAM- 8MB RAM, 4MB graphics RAM, 4MB EEPROM, andnMPEG2 decoding. My guesses about what was inside were pretty good. I'dnlove to get my hands on a broken unit and take it apart.