~ WTV SECURITY INDEX ~
Group: alt.discuss.webtv.hacking Date: Fri, May 5, 2000, 10:00pm From: ulTRAX@webtv.net TELLYSCRIPT The Tellyscript is central in maintaining order in WNI's universe. Since it contains phone connection data, it controls what servers we connect to and therefore what IP list is downloaded so we can successfully connect with that service. In our case we are relegated to Production services but we know there are other WTV services out there such a previews, weekly, daily, etc. The Tellyscript also contains modem instructions. I think it's time to start a discussion on how Builds, contact numbers, WNI services, and the Tellyscript are all interrelated. Some of this may be old news for some here but these discussions often have a way of sparking new avenues of inquiry. Grim, Bone... you out there LOL
Group: alt.discuss.webtv.hacking Date: Fri, May 5, 2000, 9:49pm (EDT-3) From: efficient1@webtv.net (examine) Re: TELLYSCRIPT One thing for certain is webtv has done there homework when it comes to us production trying to connect to other servers.Back when there was as many holes in wtvs software as a =A0 box of fruit loops. We were able to expose webtv's software and connect to TestDrive, Thrashnet, JP, UK and a hand full of other servers! But know i find it almost impossible to do unless we knew somebody from the inside.They have killed almost every possible way.wtv-1800:/xxxx-xxx?x-baggage-xxxxx=3Dxxx- are no longer accessible. They have pulled every daily, weekly non-production build. The only way is by somebody from with-in wtv to tell us a modem code that works! Until then it's a lost cause. These are just my thoughts
Group: alt.discuss.webtv.hacking Date: Fri, May 5, 2000, 11:35pm (EDT-3) From: efficient1@webtv.net (examine) Re: TELLYSCRIPT Alot of people would agree with me that hacking with-in the webtv network is alot harder then it use to be. Webtv never thought for once that it would have such a problem with people tampering with their software. They deserved everything they got and deserve everything thats coming to them!
Group: alt.discuss.webtv.hacking Date: Sat, May 6, 2000, 3:02am (EDT-3) From: CLUBTURBO@webtv.net (Jon=A0Holstrom) Re: TELLYSCRIPT And what about the fact that webtv boxs have to logon to a LAN to get any info at all, much less download new software,
Group: alt.discuss.webtv.hacking Date: Sat, May 6, 2000, 12:18pm (EDT-1) From: I-Dunno-X@webtv.net (BONE_33) Re: TELLYSCRIPT OK, On the Vend-A_Telly page, it will say "Probably a non-artemis connection". Below that there are some Big Bob's Super Scripts. I clicked this one on " Dial Artemis ATV0MS6=3D10X4S10=3D0S11=3D110DT+465-35= 37" it worked and the Vend-A-Telly page said I had an Artemis connection. I slightly modified the code like this "ATV0MS6=3D20X6S20=3D0S11=3D220DT+465-3537", it did connect and was still = an artemis connection. I tried many combinations of this modified command, but only the above one would work. I tried to see what the differience was at that time (over a year ago) but couldn't tell.(builds ect.) With the recent methods that have been used to get around in the Network this might have been useful. By the time I had heard about that modem comannd trick, it had already been shutdown. As far as the difference between an Artemis and Non-Artemis connection is still unknown to me. Later BONE_33
Group: alt.discuss.webtv.hacking Date: Sun, May 7, 2000, 1:10pm From: ulTRAX@webtv.net Re: TELLYSCRIPT ip mystery Aside from getting an IP list from the Tellyscipt... or maybe more precisely a set of Production IPs.... we also access new IPs going to FLASH or DEMO. Yet, it's clear we have not gone scriptless, have we reloged in, nor dialed another phone number. There's something here we are missing.... some understanding of how we are assigned these new IP lists.... yet it's these downloaded IP lists that are one of the Keys to the Kingdom. I also bet, and I don't think this question was ever answered, whether those who got into Tricks had a different IP list when they got there. Would we get a new IP list just going into TRICKS/INFO? (think that PW is still the same as on the TRICKS INDEX source code?) Perhaps we need to start a project using the AutoHack Cache Reader to get what info we can about what happens going into DEMO and FLASH before the upgrade kills this tool. It's not just the list we're getting... it's a specific list. An implication of this may be to finally figure out how many Flashes and Demos there are.
Group: alt.discuss.webtv.hacking Date: Sun, May 7, 2000, 12:41pm (EDT-1) From: I-Dunno-X@webtv.net (BONE_33) Re: TELLYSCRIPT ip mystery (ulTRAX) I'm am pretty sure you know this, but when we access Demo or Flash, we do not get a full showservices list... the services that we cannot use like mail are not on your IP list. BONE_33
Group: alt.discuss.webtv.hacking Date: Mon, May 8, 2000, 6:40am (EDT-1) From: limdog@webtv.net (limdog) Re: TELLYSCRIPT ip mystery it might be tied to a time function like our floating port #s When going back and forth to auto and tricks you might need to enter the pass again after, say about 10 min. right?
Group: alt.discuss.webtv.hacking Date: Mon, May 8, 2000, 5:49am (EDT-3) From: efficient1@webtv.net (examine) Re: TELLYSCRIPT ip mystery That is correct after you accessed tricks via jetski20 10 or 15 mins later it kicked you back to the passwd page were you had to reenter the passwd again!!!!
Group: alt.discuss.webtv.hacking Date: Mon, May 8, 2000, 9:16pm From: GrimIo@webtv.net Multiple TellyScripts On Box, Burn-in, AD, Etc. Ok, hope this makes some sense. On the old Classic there appears to be two TellyScripts stored on the box. The first one is the one that is normally issued during initial registration, after blasting NVRam, etc. You might as well call it the "Production TellyScript". The second appears in the Classic's BootROM (version 105). Neither of them are remotely related to each other, I want to make that clear now. To see what I mean. Those of you on an old Classic, pick a build, and try to upgrade your box. You'll notice at the first screen it should say something like "Dialing WebTV". Now turn the box off and hit "Reset" a few dozen times and do poweroff code 07081976. You should see that you're "Dailing Toll-free", in otherwords, you're getting a new TellyScript. Ok, take the upgrade, and hit "Connect" afterwards. Once it powers back on you should be dialing your ISP, in otherwords, that TellyScript wasn't cleared (otherwise you'd dial toll-free). Well, by now you're probably saying, "Yeah, but I got a new TellyScript while dialing in for the upgrade, so that's why it doesn't dial toll free". You're wrong my friend, you can't tell, but there are two totally different ones on the box. I don't want to really explain how I know this, lets just say I do. I used to think differently, but don't anymore. AccountDisabled is also tied in with the TellyScript. I don't really have that much info on it, but I know the AccountDisabled screen, "Need to Redial", plays a large part in the WebTV servers. The most I can tell right now is that when we have an "incorrect" TellyScript so to speak, that this screen appears before login. Pressing "Redial" or "Reconnect" (whatever it is) forces the box to redial toll-free for a new TellyScript. The odd thing is that if you power off then back on at the "Need to Redial" screen, you won't be at it next time you power on. I think it also plays a part in things such as the box's internal settings. Just to prove my point, how many of you have visited AD and dialed toll-free the next time you logged on. Most of you can say you did. Also, technically we don't need an Internal build to get to TestDrive or Previewer status to access the "Previewer Realm". All we need is the right TellyScript to connect us to that server. More than likely, if I had the right phone number to get the right TellyScript, I could dial into any server I wanted, including Corp. A great example of that is Manufacture Burn-in. It is my belief that the TellyScript also controls certain client:commands on our box. I could swear to God that client:tourist worked while in Burn-in but my memory is a bit foggy on that subject. When was Tourist killed? If it was killed with 1.4 (2.2) then I am right because in Bad-Brads Burn-in pics, he clearly was on a tour. How you tell is because in the right hand side of status bar there are numbers. I think they mean how many sites you've been to and how many links are on that site. That's about all for now.
Group: alt.discuss.webtv.hacking Date: Tue, May 9, 2000 From: ulTRAX@webtv.net Re: TELLYSCRIPT (?) Back in Aug 98 I downloaded an Internal build from TDrive. For a possibly a few days it ran fine connecting to Production Services. The I played with the head-waiter:/login code... or somesuch. It was at that point I was kicked back to the 800#. When I reconnected I was in TDrive. Seems as long as the Tellyscript is undisturbed, it functions as it was intended. Once the box goes scriptless, the Build directs the box to get a new TScript. In my case it was a script to connect to the TDrive IPs.
Group: alt.discuss.webtv.hacking Date: Mon, May 8, 2000, 9:51pm (EDT-3) From: jasmat14@webtv.net (Jasmat) Re: Multiple TellyScripts On Box, Burn-in, AD, Etc. I wish I had really explored what I got into almost a year ago so I could elaborate on this. I don't think grim should elaborate too much on his findings, but he can help us understand it better. One special screen I found when I was having troubles with my Plus and Classic (the screen was only available on Classic) allowed the user to dial in a connection number of their choice or a dialing pattern. I haven't seen much posted at all about dialing patterns yet... but this unmentionable page had a "keypad" of letters and numbers but also allowed you to set what number you want to dial in to. You just had to know what connected to what. It's definitely not a guessing game...When I first used it I got a new tellyscript (for the time being) and dialed into something I had heard and dreamed about but never experienced before. No it was not corp or previewers but it was cool and a great pathway. Am I phrasing this wrong Shawn? About client:tourist...damn I should've tried it. I know that that's probably what the whole Tourist page was meant for...at least something to see while in Burn-In. I also think Shawn is correct about the numbers...I strongly support him on that statement :-) Even if you know 10 connection numbers from the same source of the "ticket" that doesn't mean they each connect you to a fascinating service. For some reason one 1800 dial-in worked for me to get me past "Must Upgrade Now" but not for others. I believe it's the long-distance numbers that count. Too bad someone had to ruin the whole thing and the page is now gone, to my knowledge. The number now is worhtless...doesn't connect to anything special. In fact I think it would be fine to post it just for archiving...I need to find some of my old e-mails and notes saved somewhere (probably will take days to find where and the pws to get in lol) to correct anything and to add on. I find our Tellyscript most interesting and especially linking our boxes (ssid's) with connection numbers. How about ANI? Any way to spoof our own dialin? I think down the line of much more observations and speculations and some surprising feats, this will become the central topic for quite a while. For now how about an "Explanation"? Lol...NeMAK?
Group: alt.discuss.webtv.hacking Date: Tue, May 9, 2000 From: ulTRAX@webtv.net Re: Multiple TellyScripts On Box, Burn-in, AD, Etc. jasmat14 wrote: "One special screen I found when I was having troubles with my Plus and Classic (the screen was only available on Classic) allowed the user to dial in a connection number of their choice or a dialing pattern. I haven't seen much posted at all about dialing patterns yet... but this unmentionable page had a "keypad" of letters and numbers but also allowed you to set what number you want to dial in to." This has been posted on before. Back in Dec there was a major hunt to track down that page on Pluses. A first step would have been to get the URL from Classics. It has to be an file://rom/htmls URL since it's available without being on-line. I'm sure WNI knows it's there, it's not that hard to get to, and your description is sufficient to let corp know what you're talking about.