WebTV Wiki - User contributions [en]

Installing Linux on the MSN TV 2 (RM4100)

2023-12-29T02:26:29Z

Wtv-411: /* Connect the serial port */ Remove serial port image for now because I personally don't like the current one anymore

The [[MSNTV 2|MSN TV 2]] was an internet appliance made by Microsoft that was designed as an upgrade to the first generation WebTV/MSN TV internet appliances. It introduced broadband, support for media playback, and an upgraded browser engine based on Microsoft's Internet Explorer 6 browser. The boxes were manufactured by RCA with the model number RM4100. They're also known to be decent Linux machines, and hacking the boxes to load Linux doesn't require a lot of effort. The first, and currently, the only method for doing this was discovered by Chris Wade in 2006, which involved a 4-pin serial port attached to the RM4100 motherboard and using it to flash a patched version of the MSN TV 2's BIOS by injecting shellcode directly into RAM. This patched BIOS would load a Linux kernel from the box's CompactFlash card on boot up in place of the stock MSN TV 2 firmware. Considering that the available guides for doing this are almost two decades old and are somewhat outdated nowadays, this guide will offer up-to-date and clear instructions for those interested in turning their MSN TV 2 box into a Linux machine. MSN TV 2 boxes nowadays are pretty rare to come by, though, and since the available kernels for them are built from very old versions of Linux, you might not be able to get much out of the MSN TV 2 running Linux these days.

This guide will assume that you're using the original toc2rta Linux kernel (the one without video out support). I (the wiki admin) won't go over installing the kernel with video out support as one, the only version of that available online requires compiling the Linux source code, which I have no experience with, and two, the compiled version is no longer available anywhere. This will also assume that you'll only use the stock CompactFlash card that comes with the MSN TV 2 to flash the patched BIOS and load Linux from. It's possible to add a hard drive for extra storage if you're able to solder an IDE port onto the motherboard, but that's out of the scope of this guide. One of the steps in this guide also requires that you have a Linux or macOS system available to you or a Linux environment compatible with Windows installed on your computer, since right now there's no working native equivalent for Windows computers. I'm hoping I can find a solution for that at some point in the future.

''- wtv-411''

== What You Need ==

To perform this hack, you will need:
* An MSN TV 2 (RM4100) set top box
* A tool to pry off the rubber feet from the bottom of the MSN TV 2 (i.e., a spudger)
* A computer (Right now, Linux or macOS will have to be involved at some point during this guide)
* A CompactFlash reader
* A TTL adapter - one that connects to USB is recommended
* kernel.zip and rootfs.tar.gz ([https://archive.org/details/msntv2-linux-files Mirror])
* The patched MSN TV 2 BIOS, which loads the Linux kernel. You can download this on Archive.org at https://archive.org/details/msntv2-linux-bios.

== Disassembling the MSN TV 2 ==

Before you can get to installing Linux on the MSN TV 2, you'll have to get access to the hidden LVTTL serial port on the MSN TV 2's motherboard. To do this, you'll have to disassemble the shell of the set top box.

(The following steps have been copied and slightly edited from [[MSNTV 2/Extracting System Content]])

Before you can unscrew anything, you'll have to cut or remove the sticker with trademark information that's conveniently placed on the right side of the back of the MSN TV 2 box, which holds the two parts of its plastic shell together and prevents it from being fully removed. Since MSN TV has long since been defunct, tampering the sticker should no longer be a concern. You can slice this sticker by the crease it holds together, or go through the tedious process of completely removing it. Whatever method you choose, the two halves of the shell will be fully separated once the sticker is dealt with and now you can finally get to unscrewing the unit.

Do you see the four rubber feet on the bottom of the unit? Underneath those are four screws that you'll have to unscrew to remove the bottom half of the box's shell. Pry off each rubber foot and then unscrew each of the four screws with a Philips head screwdriver. Now gently remove the bottom half of the shell and you'll see a metal cage with even more screws that hold the motherboard and top half of the plastic shell together. Specifically, there are 5 screws holding the metal cage: two on the left, two on the right, and one somewhere in the middle. Unscrew all 5 screws with the Philips head screwdriver, and once you're done, remove the metal cage from the top half of the shell and flip it over.

== Connect the serial port ==

Once you've fully disassembled the shell, remove the top of the metal cage. The serial port should be at the bottom left of the motherboard and have 4 pins.


The pinout for the serial port is (from left to right):

* 1 - TX
* 2 - RX
* 3 - GND
* 4 - 3.3V

The serial port on the MSN TV 2 operates at 3.3V. You can buy a USB to TTL adapter for cheap that supports this voltage. At least in this case, the 3.3V pin doesn't have to be connected. The TX and RX connections from the adapter you're using might also have to be reversed on the MSN TV 2's TX/RX pins.

== Prepare the CompactFlash card ==

Now take out the CompactFlash card from the MSN TV 2 and plug it into a computer. Before doing anything, I recommend you image the card in case you corrupt it and have to start over. Make sure you've downloaded kernel.zip, rootfs.tar.gz, and the patched BIOS before continuing. First, unzip all three files. In the unzipped kernel folder, copy the vmlinux.bin and cmdline files into the first partition of the card (this usually contains files for booting the MSN TV 2 firmware, such as BOOT.PRF and NK.BIN. Keep these in the partition for now). vmlinux.bin is the Linux kernel that the MSN TV 2 will boot Linux from, and cmdline is a text file containing the config for the kernel. If you're feeling adventurous, feel free to edit this file. Copy the patched BIOS from its folder, which has the filename "linux_patched_bios.bin", to the first partition with the filename "BIOS.BIN". If you're copying these files in Windows, make sure to remove the Archive attribute from vmlinux.bin and cmdline on the card as it's reported that Linux won't boot otherwise. You can do this by accessing the drive letter of the first partition in Command Prompt and running the following commands:

attrib -A vmlinux.bin
attrib -A cmdline

Next, you'll have to overwrite the entire third partition of the CF card (which contains at least three folders named "Init", "Print", and "Shell") with the rootfs.img file you extracted from rootfs.tar.gz. If you have a Linux or macOS system, or if you have a Linux environment installed on Windows, it's as simple as running <code>dd if=rootfs.img of={CF_3RD_PART}</code>, <code>{CF_3RD_PART}</code> representing the device name of the third CF card partition mounted on the computer (assuming no other removable devices are connected, this is usually "/dev/sda3"). Currently, there's no known way to do this natively in Windows.


Once everything's done, put the CompactFlash card back into the MSN TV 2.

== Flashing the patched BIOS ==

If everything's set up properly, try connecting to your serial device by using your serial terminal of choice and connecting to the COM port of your serial device at 115200 baud (Linux users can use minicom or screen, Windows users can use PuTTY. macOS users may have to perform extra steps to get their serial device recognized). You should be able to connect with no issues if your serial device is working. Now, power on the MSN TV 2 and wait for it to send <code>#</code> to the terminal. As soon as you see this character, immediately reply with a <code>$</code>. If you do this quick enough, you should end up triggering the "MSNTV Service Menu". The following text that'll be printed will look similar to this:

OK

MSNTV Service Menu
BoxID: xxxxxxxxxxxxxxxxxxxx
Version: 1 Build: 387 MSNTV CRC: 758646167 MD5: FEC7884E 15CB25B6 8C59A9FA 4A6D0195
POST: 00

Followed by a list of commands supported by the menu. If you don't respond to the <code>#</code> command in time, then simply plug out the power from the MSN TV 2 and plug it back in to try again.

Once you successfully trigger the service menu, now's where the good stuff begins. In order to flash the patched Linux-capable BIOS, the people over at Toc2rta devised a method to inject shellcode into the MSN TV 2's RAM that overrides one of the service menu functions and flashes the patched BIOS from the CF card when executed. The function in particular is the video test command (<code>v</code>).

First, type in "x" in the terminal to go to the "Examine memory" program in the service menu. Then, copy and paste each command in the following list one by one into your terminal to fully inject the shellcode:

(The following commands will only work on RCA RM4100 units. Thomson IP1000 units use a different set of commands that we won't include here for now. A disassembled version of this shellcode can be found [[MSN TV 2/Linux Shellcode Disassembly|here]])

<pre>
M 4 0x0082E160 0x82E1D368
M 4 0x0082E164 0x0FEEE800
M 4 0x0082E168 0x036A0000
M 4 0x0082E16C 0x82E1DE68
M 4 0x0082E170 0xAB1EE800
M 4 0x0082E174 0xFF68FFFD
M 4 0x0082E178 0x68FFFFFF
M 4 0x0082E17C 0x00100000
M 4 0x0082E180 0xB286E850
M 4 0x0082E184 0xC481FFFD
M 4 0x0082E188 0x00000018
M 4 0x0082E18C 0x0000003D
M 4 0x0082E190 0x68117F00
M 4 0x0082E194 0x0082E1FB
M 4 0x0082E198 0x000FBBE8
M 4 0x0082E19C 0x04C48100
M 4 0x0082E1A0 0xC3000000
M 4 0x0082E1A4 0x82E1E768
M 4 0x0082E1A8 0x0FAAE800
M 4 0x0082E1AC 0x00680000
M 4 0x0082E1B0 0x68000000
M 4 0x0082E1B4 0x00100000
M 4 0x0082E1B8 0x10000068
M 4 0x0082E1BC 0x21C2E800
M 4 0x0082E1C0 0x0768FFFD
M 4 0x0082E1C4 0xE80082E2
M 4 0x0082E1C8 0x00000F8C
M 4 0x0082E1CC 0x0014C481
M 4 0x0082E1D0 0x68C30000
M 4 0x0082E1D4 0x68742069
M 4 0x0082E1D8 0x0A657265
M 4 0x0082E1DC 0x6962000D
M 4 0x0082E1E0 0x622E736F
M 4 0x0082E1E4 0x73006E69
M 4 0x0082E1E8 0x74726174
M 4 0x0082E1EC 0x20676E69
M 4 0x0082E1F0 0x73616C66
M 4 0x0082E1F4 0x2E2E2E68
M 4 0x0082E1F8 0x69000D0A
M 4 0x0082E1FC 0x65206F2F
M 4 0x0082E200 0x726F7272
M 4 0x0082E204 0x66000D0A
M 4 0x0082E208 0x6873616C
M 4 0x0082E20C 0x20676E69
M 4 0x0082E210 0x63637573
M 4 0x0082E214 0x66737365
M 4 0x0082E218 0x202C6C75
M 4 0x0082E21C 0x20756F79
M 4 0x0082E220 0x206E6163
M 4 0x0082E224 0x6F626572
M 4 0x0082E228 0x0D0A746F
M 4 0x0082E22C 0x00000000
</pre>

Once all the commands have been entered into the terminal, type in "q" to exit the "Examine memory" program. Then, type in "v". Assuming everything's been done correctly, the MSN TV 2 should print the following text:

Running test graphics ...
HW_TestGraphics
hi there
starting flash...

The MSN TV 2 will flicker the power and message lights back and forth while the shellcode flashes the patched BIOS. The terminal will then print "flashing successful, you can now reboot" when it's done. To reboot without touching the MSN TV 2 again, just press Enter to exit the video test, and then type in "q" to reboot the box. On reboot, the Linux kernel should boot and print to the serial terminal.

----

Congrats! You've successfully hacked your MSN TV 2 box to run Linux. Go crazy with it. I have no idea how useful they'd be nowadays, but now you can load whatever programs you want onto the CompactFlash card or run a server on it. Whatever you want to do to make it your own. It would definitely be cooler if a compiled video patch were still available or better yet, if a GUI distro or modern Linux kernel can be compiled to run on the MSN TV 2. This stuff hasn't gotten any attention in the past decade, so there's a lot of room for improvement. Feel free to join the [https://discord.gg/qke279EUa8 WebTV/MSN TV Discord] to further discuss about this topic.

TellyScript

2023-08-26T19:00:13Z

Wtv-411:

TellyScript is a scripting language used by WebTV/MSN TV clients that specifies access numbers and dialing instructions that should be used to connect to the WebTV/MSN TV network. It was designed by Andy Rubin and was based off a scripting language he had previously written in college. The name is a pun on "Telescript", a scripting language developed by General Magic, a company Rubin and many other early WebTV Networks employees worked for prior to joining WebTV.

== Overview ==
At its core, TellyScript is designed to operate as a dialing script for WebTV/MSN TV clients, while having the flexibility of a general programming language, like C. It contains both general C-like functions and dedicated, WebTV-specific functions that can be taken advantage of to have better control over the connection process. This allows TellyScripts to do things like directly initialize the modem, update the progress bar on the connecting screen at specific events when connecting, work around modem-related bugs, use one of up to eight different sets of POPs (Point of Presence) to connect to based on the day of the week, time, and month a user is connecting on, and handling different kinds of failures. On the service side, TellyScripts sent to WebTV/MSN TV clients are generated from C-like script fragments, which include common TellyScript functions, locale-specific code, code to support logging in to supported WebTV/MSN TV ISPs, and code generated on the fly, which contain the actual access numbers and if applicable, toll call warnings. These fragments are selectively combined as the service sees fit for each WebTV/MSN TV client depending on factors like what type of box or client a user is connecting with and their location. The combined fragments are then tokenized and compressed before being sent to the WebTV/MSN TV client. The service also had the ability to track the last two TellyScripts sent for each WebTV/MSN TV client in the event the script computed on the service is different and has to be updated (the last two are tracked to accomodate the quirk of WebTV/MSN TV clients not saving TellyScripts to NVRAM unless they're powered off).

On the client side, a TellyScript is obtained by first being downloaded off the [[WTVP/Processes/First-Time Registration|pre-registration]] (scriptless) servers after the WebTV/MSN TV service has detected that the user's location is supported (this is based off the phone number they've dialed in from, or a number the user specified directly on the service if their phone line doesn't support ANI). The box will store this script in NVRAM and use it for all future connections unless it's cleared or replaced.

The scripting language used by TellyScript is based off a C-like language that utilized byte-sized tokens for keywords, data types, and general script flow. It also utilized two types of compression: a simple "minification" algorithm that involves turning variable and function names into 1 or 2-letter names, and LZSS compression of the TellyScript code using a WebTV-specific variation of the algorithm.

== Structure ==
The structure of a TellyScript consists of a 36-byte header and the actual script, the latter of which is compressed and minified. The header starts with the magic string "ANDY" (0x414e4459 in hexadecimal). This is in reference to Andy Rubin, who designed the scripting language. The rest of the header contains two version fields with no known purpose, a field that possibly stores a 4-byte hash (possibly CRC32), which is used by the service to track if the client needs their script to be updated, fields for the lengths of the decompressed and compressed script data, a UNIX timestamp of when the script was generated, and an unknown field that has no discernable purpose right now. All integers in the header are packed as big endian 32-bit values.

The following table will be provided to document the header:

{| class="wikitable
! Field Name !! Type !! Offset !! Description
|-
| Magic bytes || uint32 || 0x00 || Magic bytes identifying TellyScript header. Value always should be <code>0x414e4459</code> (<code>ANDY</code> in ASCII)
|-
| "version1" || uint32 (possibly) || 0x04 || Use unknown. Value is usually 1
|-
| "version2" || uint32 (possibly) || 0x08 || Use unknown. Value is usually 1, but has been reported to have a different value in at least one TellyScript
|-
| "hash1" || uint32 || 0x0c || Possibly a CRC32 hash. Sent in WTVP request messages in the <code>wtv-script-id</code> header if a client has a valid TellyScript. This hash value was read by the WebTV/MSN TV service to track if clients needed their scripts to be updated
|-
| Time created || uint32 || 0x10 || UNIX timestamp of the exact date and time a TellyScript was generated from the WebTV/MSN TV servers. Sent in WTVP request messages in the <code>wtv-script-mod</code> header if a client has a valid TellyScript
|-
| Compressed script length || uint32 || 0x14 || Length of LZSS compressed script
|-
| Decompressed script length || uint32 || 0x18 || Length of decompressed script
|-
| Decompressed script hash || uint32 || 0x1c || CRC32 hash of decompressed script
|-
| "unknown1" || uint32 (possibly) || 0x20 || Unknown value. Always has value 0x0101ffff from looking at archived TellyScripts
|}



Information on the tokenized scripting language is too extensive for us to simply write up here at the moment, and will possibly be added in the future when the opportunity allows us. Andy McFadden, however, has since made [https://gist.github.com/fadden/09b581dbb047945d3119048dc05e8bea source code available] that decompresses and decompiles tokenized TellyScript into readable C-like code, and is known to at least work with almost all TellyScript samples in our content archive.

== DialScript ==
DialScript is a revision of TellyScript, primarily designed for use with Windows CE-based WebTV/MSN TV clients (see [[UltimateTV]]). It's confirmed to have been used since the Microsoft TV iteration of WebTV technology, but its inception seems to go back as far as 1999, as it was mentioned in a revision of the "[[Greater Scroll of Dialing Wisdom]]" document published in the same year. It's believed that it was used well into the [[MSNTV 2]]'s lifespan as well.

The only known differences between DialScript and TellyScript is that DialScripts appears to use a different magic string - <code>VKAT</code>, most likely in reference to Venkatesh Krishnamurthy, the person who is credited in the "Greater Scroll of Dialing Wisdom" for being "in charge" of DialScript. The script data itself, when decompressed, also has 8 extra bytes at the beginning that don't appear to be part of the script itself and are currently undocumented. Outside of that, the core scripting language used by DialScript appears to have been unchanged from the original TellyScript incarnation. The script contents, however, make more use of system calls for modem stuff. This was likely to take advantage of Windows CE APIs to manage the modem as opposed to doing it at the low level in the script.

== Availability ==
Thankfully, with the releases of eMac's "server emulator" over the years, alongside other sources, some TellyScripts and DialScripts have been preserved. For our own curiosity's sake, though, we would be interested in more versions of these TellyScripts and DialScripts for any version of WebTV/MSN TV. If you got any of them or other WebTV/MSN TV stuff we're looking for, don't hesitate to [[Wanted|send them over to us]]!

== External Links ==
* [https://gist.github.com/wtv-411/6c3e4b4cfce495d8cc56fe634b2e35c5 De-tokenized script from a TellyScript generated on May 27, 1998 for an Old Classic]

Template:Network/Protocols/WTVP/wtv-services/A-F

2023-08-13T05:27:23Z

Wtv-411: Fix typo for ftp service port

{| class="wikitable"
! Service Name || Description || Common Ports || Supports SECURE method?
|-
| wtv-aroundtown || Unknown || 1628 || ?
|-
| wtv-author || [[Services/Gallery/Page Builder|Page Builder service]] || 1643 || Yes
|-
| wtv-census-udp || Specifies a UDP server for a WebTV/MSN TV client to connect to for [[Metering protocol|metering services]], if metering is configured to be enabled || 1657 || No (custom UDP protocol)
|-
| wtv-center || Hosts various aggregated sections (also known as [[Services/Gallery/Centers|info centers]]) of the WebTV/MSN TV service (Around Town, Money, WebTV Today, etc.) || 1639 || Yes
|-
| wtv-chat || Hosts [[Services/Gallery/Chat|Chat]] services || 1630 || Yes
|-
| wtvchat || Possibly the same as <code>wtv-chat</code>, just with a slightly different change in name || 1630 || Yes(?)
|-
| wtv-content || Hosts various misc. content such as video, images, and demos || 1629 || Yes
|-
| wtv-cookie || Service for managing website cookies on individual user accounts || 1619 || Yes
|-
| wtv-customscript || Service that facilitates creation of custom TellyScript for the box to use when dialing || 1623 || Yes
|-
| wtv-disk || Downloadable content service for WebTV Plus units || 1635 || Yes
|-
| wtv-epguide || Electronic Program Guide service. Used to give WebTV Plus units TV listings || 1633 || ?
|-
| wtv-explore2 || [[Services/Gallery/Explore|Explore section]] of WebTV. As ulTRAX put it, "Explore was wasteland of ads presented as a public service" || 1625 || ?
|-
| wtv-explore || Probably similar to wtv-explore2 || 1625 || ?
|-
| wtv-favorite || Hosts [[Services/Gallery/Favorites|Favorites]] services || 1611 || Yes
|-
| wtv-flashrom || Flash update services. Allows the box to download flash updates to the system software || 1618 || Yes
|-
| wtv-forum || Functions similarly to <code>wtv-news</code> || 1605 || Yes
|-
| file || File URI content proxy service(?). Dunno why there's a service definition for this || 1650 || ?
|-
| ftp || Believed to be an FTP content proxy service || 1650 || ?
|}

Template:Network/Protocols/WTVP/wtv-services/L-P

2023-08-13T05:09:55Z

Wtv-411: Add wtv-music (confirmed to be a real service)

{| class="wikitable"
! Service Name || Description || Common Ports || Supports SECURE method?
|-
| wtv-log || Usage logging/telemetry services || 1609 || Yes
|-
| wtv-mail || [[Services/Gallery/Mail|E-mail services]] || 1608 || Yes
|-
| mailto || <code>mailto</code> -> <code>wtv-mail</code> proxy service. Goes to the "Write an e-mail" page with the email address field pre-filled || 1608 || Yes
|-
| wtv-music || Service that hosts music content for WebTV/MSN TV background music || 1656 || Yes
|-
| wtv-news || Hosts [[Services/Gallery/Discuss|Discuss]] (newsgroup) services for WebTV/MSN TV || 1605 || Yes
|-
| news || Newsgroup URI proxy. Redirects newsgroup requests to WebTV/MSN TV's own Discuss service || 1605 || Yes
|-
| wtv-notices || Unknown || 1622 || ?
|-
| wtv-onair || Unknown || 1648 || ?
|-
| wtv-partner || Unknown || 1638 ||
|-
| wtv-passport || Authentication for Passport accounts within WebTV/MSN TV. Currently only seen in use for Messenger login process || 1654 || Yes
|}

WTVP/Headers/List

2023-08-11T21:25:16Z

Wtv-411: Add Cookie and Set-Cookie headers, User-Agent header can be sent server-side too for WebTV

{{WTVPNav}}

List of known recorded WTVP headers. Most have been copied from http://web.archive.org/web/20041026232010/http://ubergeek03.mine.nu/WebTV/WebTVPHeaders.html, but we've contributed some previously unknown headers we've been able to observe, along with adding descriptions and command header classifications for all headers.

Got any information you'd like to contribute to this? [[Wanted|Send it over to us]] and it might be added onto here.

{| class="wikitable"
! Header Name !! Description !! Type !! [[WTVP#Command_Headers|Command Header?]] !! Server? !! Client?
|-
| Accept-Language || Standard HTTP header || string || No || || <center>X</center>
|-
| Cookie || Standard HTTP header || string || No || || <center>X</center>
|-
| Connection || Standard HTTP header. WTVP was designed with persistent connections in mind, but official WNI servers have been seen sending a <code>Keep-Alive</code> Connection header in responses nonetheless || string || No || <center>X</center> ||
|-
| Content-length || Standard HTTP header || integer || No || <center>X</center> || <center>X</center>
|-
| Content-type || Standard HTTP header || string || No || <center>X</center> || <center>X</center>
|-
| Date || Standard HTTP header. Probably only present when connecting through Microsoft TV services || timestamp || No || <center>X</center> ||
|-
| Expires || Standard HTTP header || timestamp || No || <center>X</center> ||
|-
| Set-Cookie || Standard HTTP header || string || No || <center>X</center> ||
|-
| User-Agent || Standard HTTP header || string || No || <center>X</center> || <center>X</center>
|-
| Approx-Content-Length || Sent in some responses from the WebTV/MSN TV web proxies. Contains the length of the original data for the queried resource before being sent as multipart data || integer || No || <center>X</center> ||
|-
| mstv-checkurl-mode || Value currently observed as "1". Only seen when connecting through Microsoft TV services. Function unknown || ??? || ? || <center>X</center> ||
|-
| mstv-client-caps || Only seen when connecting through Microsoft TV services. Function unknown || ??? || ? || || <center>X</center>
|-
| mstv-listing-id || Value currently observed as "C1020". Only seen when connecting through Microsoft TV services. Function unknown || string || ? || <center>X</center> ||
|-
| smartcard-data || When connecting to the WebTV/MSN TV service with a compatible smart card inserted, a box will send this header in WTVP requests with the raw smart card data. || string || No || || <center>X</center>
|-
| passport-domain || Domain name of the Passport account (now Microsoft account) linked to the current WebTV/MSN TV subscriber/user account || string || No || <center>X</center> ||
|-
| user-id || Appears to be a long string of numbers || integer || No || <center>X</center> ||
|-
| wtv-addresses-url || Contains a service URL for listing all the user's stored addresses. Addresses are sent with the name, followed by a null byte, then the address with another null byte at the end. This is used for the Address panel. Value currently observed as <code>wtv-mail:/addresslist</code>. || URL || No || <center>X</center> ||
|-
| wtv-ahuf || ??? || ??? || ? || <center>X</center> ||
|-
| wtv-allow-dsc || Value currently observed as "true". Function unknown || boolean || No || <center>X</center> ||
|-
| wtv-backgroundmusic-add || Specifies sound files as selected by the subscriber/user to add to the background music queue || URL || Yes || <center>X</center> ||
|-
| wtv-backgroundmusic-clear || Apparently clears backlog of predefined background music to play. Value currently observed as "no_zits" || string || Yes || <center>X</center> ||
|-
| wtv-backgroundmusic-load-playlist || Sets a service URL for the client to query to get the list of background music for the user currently logged in. This header is known to be sent in the response for the [[WTVP/Processes/Retrieving settings|settings service]]. Value currently observed as <code>wtv-setup:/load-playlist</code> || URL || No || <center>X</center> ||
|-
| wtv-backgroundmusic-remove || Probably similar to wtv-backgroundmusic-add but for removing queued background music || ??? || ? || <center>X</center> ||
|-
| wtv-boot-message-led-state || Sets the state of the message light. Value currently observed as "blinkSlow". Need more documentation on this || string || ? || <center>X</center> ||
|-
| wtv-boot-url || Value currently observed as <code>wtv-head-waiter:/login?</code>. Need more documentation on this || URL || No || <center>X</center> ||
|-
| wtv-bypass-proxy || ??? || boolean || No || <center>X</center> ||
|-
| wtv-capability-flags || A hexadecimal string that [[Capability Flags|identifies the capabilities of a WebTV/MSN TV client]], and affects how the service functions on it. Need more documentation on this || string || No || || <center>X</center>
|-
| wtv-ccs || ??? || ??? || ? || <center>X</center> ||
|-
| wtv-challenge || A structured BLOB value that's sent by the server during the headwaiter login stage. Starts the [[WTVP/Processes/Headwaiter#Challenge/Response|challenge/response process]]. When decrypted, it contains random "challenge data" that has to be sent back in the challenge response, along with two sessions keys needed to facilitate <code>SECURE</code> communication, among other data. || BLOB || No || <center>X</center> ||
|-
| wtv-challenge-response || Used during the headwaiter [[WTVP/Processes/Headwaiter#Challenge/Response|challenge/response process]] to respond to the challenge with another structured BLOB value that is verified by the server. Sends back the "challenge data" from the wtv-challenge encrypted with the initial key. || BLOB || No || || <center>X</center>
|-
| wtv-check-url || ??? || ??? || ? || <center>X</center> ||
|-
| wtv-clickthru-redirect || ??? || ??? || ? || <center>X</center> ||
|-
| wtv-client-address || Has an IP address of sorts, presumably of the box connecting to the server || string || No || || <center>X</center>
|-
| wtv-client-bootrom-version || An integer that identifies... the boot ROM version? || integer || No || || <center>X</center>
|-
| wtv-client-date || Human-readable timestamp in GMT, most likely the date of when the subscriber/user successfully logged on. Need more documentation on this || timestamp || No || <center>X</center> ||
|-
| wtv-client-rom-type || Identifies the ROM type a WebTV/MSN TV box is running || string || No || || <center>X</center>
|-
| wtv-client-serial-number || [[Silicon Serial ID|SSID]] of the WebTV/MSN TV box - identifies who is sending a WTVP request || string || No || || <center>X</center>
|-
| wtv-client-time-zone || Time zone that corresponds to the user's current location, in both name and offset (e.g., "PDT -0700"). It is speculated that this value is determined on the service side by using the user's ANI number when a box dials into the toll-free access number || string || No || <center>X</center> ||
|-
| wtv-connection-timeout || Value currently observed as "90". Function unknown || integer || No || <center>X</center> ||
|-
| wtv-connect-session-id || Some hexadecimal value we can't figure out the purpose of. Function unknown || string || No || || <center>X</center>
|-
| wtv-country || Two-letter country code. Most of the time it's just set to "US" though. Need more documentation on this || string || No || <center>X</center> ||
|-
| wtv-datadownload-checktimeoffset || ??? || integer || No || <center>X</center> ||
|-
| wtv-datadownload-login-url || Contains the URL the box accesses when connecting for DataDownload. Value currently observed as wtv-head-waiter:/login?DataDownload=1. Also used to unlock TV Home on WebTV Plus boxes and change the offline home page on WebTV Dreamcast. || URL || No || <center>X</center> ||
|-
| wtv-datadownload-url || Contains a service URL. Value currently observed as <code>wtv-disk:/download-list</code>. Function unknown || URL || No || <center>X</center> ||
|-
| wtv-demo-mode || Value currently observed as "0". Function unknown || integer || No || <center>X</center> || <center>X</center>
|-
| wtv-doug || ??? || ??? || ? || <center>X</center> ||
|-
| wtv-echostar-ca || Unknown function. Value observed as "0x0" || ??? || ? || || <center>X</center>
|-
| wtv-echostar-receiver || Unknown function. Value observed as "R0022040763-84" || ??? || ? || || <center>X</center>
|-
| wtv-echostar-rom || Unknown function. Value observed as "121PBWDA-F-100BBWDA" || ??? || ? || || <center>X</center>
|-
| wtv-echostar-smartcard || Unknown function. Value observed as "S0004596155-62-DNASP003 Rev381" || ??? || ? || || <center>X</center>
|-
| wtv-edit-addresses-url || Specifies the URL used for the "Edit Addresses" button in the Address panel. || ??? || ? || <center>X</center> ||
|-
| wtv-element-logging || Sent in the post-login headwaiter response (for BPS/New Classic boxes at least). Unknown function. Value observed as <code>60 1</code> || ??? || ? || <center>X</center> ||
|-
| wtv-enable-jellyscript || ??? || ??? || ? || <center>X</center> ||
|-
| wtv-encrypted || Sent by the server most likely to tell the WebTV/MSN TV box if a response is encrypted || boolean || No || <center>X</center> ||
|-
| wtv-encryption || Tells the server if the WebTV/MSN TV box can understand encrypted communication (<code>SECURE</code> method?). Resulting behavior unknown || boolean || No || || <center>X</center>
|-
| wtv-execute-tellyscript-now || ??? || ??? || ? || <center>X</center> ||
|-
| wtv-expire || Expires the specified page in the box's page cache. || ??? || ? || <center>X</center> ||
|-
| wtv-expire-all || Similar to wtv-expire, but expires all assets for a page as well. Is also used to expire entire page types in some cases (e.g: wtv-expire-all: wtv-) || URL || Yes || <center>X</center> ||
|-
| wtv-explanation-url || Only observed in error responses. Contains a service URL that so far is only known to point to the <code>wtv-guide</code> service. Most likely used to give the subscriber/user a page describing the error they encountered || URL || No || <center>X</center> ||
|-
| wtv-explore-url || Contains a service URL. Value currently observed as <code>wtv-explore2:/top</code>. Function unknown || URL || No || <center>X</center> ||
|-
| wtv-fader-timeout || Value currently observed as "900". Function unknown || integer || No || <center>X</center> ||
|-
| wtv-favorite-index-url || Contains a service URL related to the <code>wtv-favorite</code> service. Used for the F keys on the keyboard. Value currently observed as <code>wtv-favorite:/favorite-index?</code> || URL || No || <center>X</center> ||
|-
| wtv-favorites-folders-url || Contains a service URL related to the <code>wtv-favorite</code> service. Used for the list of favorites on the save panel. Value currently observed as <code>wtv-favorite:/list-folders</code> || URL || No || <center>X</center> ||
|-
| wtv-favorite-url || Contains a service URL related to the <code>wtv-favorite</code> service. This is used to define the Favorites page that should be used for the "Favs" button on the keyboard. Value currently observed as <code>wtv-favorite:/favorite</code> || URL || No || <center>X</center> ||
|-
| wtv-field-name || Appears to contain the name of another WTVP header or variable sent in a <code>POST</code> request. Possibly used for detailing protocol errors. Need more documentation on this || string || ? || <center>X</center> ||
|-
| wtv-filter || ??? || ??? || ? || <center>X</center> ||
|-
| wtv-force-heavyweight-targets || ??? || ??? || ? || <center>X</center> ||
|-
| wtv-force-lightweight-targets || Value currently observed as <code>webtv.net:/</code>. Function unknown || string || ? || <center>X</center> ||
|-
| wtv-goto-url || ??? || ??? || ? || <center>X</center> ||
|-
| wtv-home-url || Contains the service URL designated to be the service home page. Value currently observed as <code>wtv-home:/home</code> || URL || No || <center>X</center> ||
|-
| wtv-https-proxy || ??? || ??? || ? || <center>X</center> ||
|-
| wtv-human-name || First and last name specified on a subscriber/user account || string || No || <center>X</center> ||
|-
| wtv-inactive-timeout || Value currently observed as "0". Function unknown || integer || No || <center>X</center> ||
|-
| wtv-incarnation || A counter sent and incremented on each first connection to a frontend server. This is needed to create the encryption key for <code>SECURE</code> communication. || integer || No || || <center>X</center>
|-
| wtv-initial-key || A small opaque, 8-byte BLOB sent during pre-registration. Facilitates [[WTVP/Processes/Headwaiter#Challenge/Response|challenge/response]] on the headwaiter. || BLOB || No || <center>X</center> ||
|-
| wtv-input-timeout || Values currently observed are "86400" and "14400". Function unknown || integer || ? || <center>X</center> ||
|-
| wtv-irc-nick || IRC nickname defined on subscriber/user account for usage with WebTV/MSN TV IRC services || string || No || <center>X</center> ||
|-
| wtv-language-header || Value currently observed as "en-US,en". Function unknown || string || No || <center>X</center> ||
|-
| wtv-link-transition-enabled || ??? || ??? || ? || <center>X</center> ||
|-
| wtv-location || ??? || ??? || ? || <center>X</center> ||
|-
| wtv-lockpage-override || ??? || ??? || ? || <center>X</center> ||
|-
| wtv-login-timeout || Value currently observed as "7200". Function unknown || integer || No || <center>X</center> ||
|-
| wtv-logo-duration || ??? || ??? || ? || <center>X</center> ||
|-
| wtv-logo-input-interval || ??? || ??? || ? || <center>X</center> ||
|-
| wtv-logo-interval || ??? || ??? || ? || <center>X</center> ||
|-
| wtv-logon || ??? || ??? || ? || <center>X</center> ||
|-
| wtv-logout-url || Contains a service URL designated for logout probably. Value currently observed as <code>wtv-logon:/logout</code>. Only seen when connecting through Microsoft TV services || URL || No || <center>X</center> ||
|-
| wtv-log-url || Contains a service URL designated for usage logging services || URL || No || <center>X</center> ||
|-
| wtv-lzpf || Observed in headers of encrypted/compressed responses. Usually has a value of 0. If present, the client uses the Huffman-based "LZPF" algorithm to decompress response data. || integer || No || <center>X</center> ||
|-
| wtv-mail-count || Stores how many unread messages the user has. If a client accesses a headwaiter service without selecting an account to log into, this header contains the total of all unread mail for all users, otherwise it only has unread mail for the currently signed in user. This also controls the message light. || integer || No || <center>X</center> ||
|-
| wtv-mail-url || Contains a service URL designated for mail service. Value currently observed as <code>wtv-mail:/listmail</code> || URL || No || <center>X</center> ||
|-
| wtv-messagewatch-checktimeoffset || Offset in seconds since midnight for [[WTVP/Processes/MessageWatch|MessageWatch]] activation. || integer || ? || <center>X</center> ||
|-
| wtv-messagewatch-url || Contains a service URL for the client to log in to on MessageWatch connections. Value currently observed as <code>wtv-head-waiter:/login?MessageWatch=1</code> || URL || No || <center>X</center> ||
|-
| wtv-messenger-authorized || Tells the box if the subscriber/user is authorized to use the Messenger feature. 1 - authorized; 0 - not authorized || integer || No || <center>X</center> ||
|-
| wtv-messenger-connect-timeout || Value currently observed as "240". Function unknown || integer || No || <center>X</center> ||
|-
| wtv-messenger-enable || Tells the box if the subscriber/user has the Messenger feature enabled. 1 - enabled; 0 - disabled || integer || No || <center>X</center> ||
|-
| wtv-messenger-login-url || Defines what service URL should be accessed for [[Services/Technical/Messenger#WTVP|Messenger login]]. Value currently observed as <code>wtv-passport:/messengerlogin</code> || URL || No || <center>X</center> ||
|-
| wtv-messenger-open-conversation-timeout || Value currently observed as "240". Function unknown || integer || No || <center>X</center> ||
|-
| wtv-messenger-passportd-timeout || Value currently observed as "240". Function unknown || integer || No || <center>X</center> ||
|-
| wtv-messenger-retry-timeout || Value currently observed as "20". Function unknown || integer || No || <center>X</center> ||
|-
| wtv-messenger-server || Defines what hostname the client should use for accessing the [[Services/Technical/Messenger|Messenger service]]. The servers this would point to were a part of the MSN/Windows Live Messenger service, a completely different service that happened to be owned by Microsoft, and is completely separate from WebTV/MSN TV || string || No || <center>X</center> ||
|-
| wtv-metering-pricing || Enables or disables [[Metering protocol|metering services]] for a supported WebTV/MSN TV build || boolean || No || <center>X</center> ||
|-
| wtv-metering-pricing-interval || Sets the time interval in seconds that WebTV/MSN TV should wait in between contacting the Metering server || integer || No || <center>X</center> ||
|-
| wtv-metering-pricing-sessionID || A 30-byte session ID WebTV/MSN TV should use when contacting the Metering server || string || No || <center>X</center> ||
|-
| wtv-metering-pricing-track-as-free || Related to metering. Function unknown || boolean || No || <center>X</center> ||
|-
| wtv-moviesearch-url || Contains a service URL designated for "moviesearch" - probably some ancillary and completely useless feature. Value currently observed as <code>wtv-content:/redirect?req-id=find-movie</code> || URL || No || <center>X</center> ||
|-
| wtv-msnchat-nick || The nickname used for accessing [https://en.wikipedia.org/wiki/MSN_Chat MSN Chat] services within WebTV/MSN TV. It appears to be similar to the value of the <code>wtv-irc-nick</code> header but with a ">" tacked onto the beginning of it (e.g., ">wtv-nick") || string || No || <center>X</center> ||
|-
| wtv-name-server || Defines an IP to use for DNS lookup. Probably not a command header, but multiple instances of this header can exist to define multiple DNS servers || string || No || <center>X</center> ||
|-
| wtv-next-reconnect-url || ??? || ??? || ? || <center>X</center> ||
|-
| wtv-noads-targets || ??? || ??? || ? || <center>X</center> ||
|-
| wtv-noback || ??? || ??? || ? || <center>X</center> ||
|-
| wtv-noback-all || Similar to wtv-noback, but can be used to disallow all of one page type (e.g: <code>wtv-noback-all: wtv-</code>). Value currently observed as "wtv-" || string || ? || <center>X</center> ||
|-
| wtv-notifications-url || The URL that a box should contact when it receives a UDP notification from [[Mail Notify]]. Value currently observed as <code>wtv-notices:/notices</code> || URL || No || <center>X</center> ||
|-
| wtv-nvstorage-dump || URL to a WTVP service that saves a box's NVRAM (flash memory) data. When this header is present in a WTVP server response, the box will immediately POST to the service URL set in the header with a portion of data from NVRAM, which includes [[TellyScript]] data stored by the box. This header will only work on builds for Old Classic (bf0app) boxes. Original URL was likely <code>wtv-1800:/post-nvstorage-dump</code> || URL || No || <center>X</center> ||
|-
| [[WTVP/Headers/wtv-offline-user-list|wtv-offline-user-list]] || Base64-encoded string. When decoded, it reveals an XML string containing a list of users a WebTV/MSN TV subscriber currently has, including their user ID, username, first/last name, password, and if they have access to mail services. Need more documentation on this || string || No || <center>X</center> ||
|-
| wtv-open-access || ??? || ??? || ? || <center>X</center> ||
|-
| wtv-open-isp-disabled || Value currently observed as "false". Function unknown || boolean || No || <center>X</center> ||
|-
| wtv-phone-log-url || Contains a service URL. Values currently observed are <code>wtv-log:/phone-log</code> on successful login, and a URL along the lines of <code>wtv-1800:/post-phone-log?t-baggage-parms=ani-950000000000,ethernet-ani-4156145500,subscriber-id-14331444</code>. It's been observed when the header is present in a response, on a WebTV Viewer at least, it will immediately query said service. Most likely used for usage logging || URL || No || <center>X</center> ||
|-
| wtv-preregistration-number || ??? || ??? || ? || <center>X</center> ||
|-
| wtv-printer-model || Value currently observed as "-1,-1". Function unknown || string || ? || <center>X</center> ||
|-
| wtv-printer-pen || Value currently observed as "0,0,1,0". Function unknown || string || ? || <center>X</center> ||
|-
| wtv-printer-setup || Value currently observed as "0,0,1,0". Function unknown || string || ? || <center>X</center> ||
|-
| wtv-print-log-url || Contains a service URL. Value currently observed as <code>wtv-log:/log</code>. Most likely used for usage logging || URL || No || <center>X</center> ||
|-
| wtv-reconnect-url || Specifies the URL the box should access when reconnecting with the Reconnect panel. || URL || ? || <center>X</center> ||
|-
| wtv-reload || ??? || ??? || ? || <center>X</center> ||
|-
| wtv-reload-all || ??? || ??? || ? || <center>X</center> ||
|-
| wtv-relogin-url || ??? || URL || No || <center>X</center> ||
|-
| wtv-rename-url || ??? || ??? || ? || <center>X</center> ||
|-
| wtv-request-rom-upgrade || ??? || ??? || ? || || <center>X</center>
|-
| wtv-request-type || Known values observed are "primary" and "prefetch". Function unknown || string || No || <center>X</center> || <center>X</center>
|-
| wtv-script-id || Carries the "hash1" value from an installed [[TellyScript]] on the WebTV/MSN TV client, or defaults to 0 if one isn't present || integer || No || || <center>X</center>
|-
| wtv-script-mod || Carries the creation time (UNIX epoch) from an installed [[TellyScript]] on the WebTV/MSN TV client, or defaults to 0 if one isn't present || integer || No || || <center>X</center>
|-
| wtv-search-url || Contains a service URL most likely designated for the search page. Value currently observed as <code>wtv-center:/search-page</code> || URL || No || <center>X</center> ||
|-
| wtv-send-thumbnail-from || ??? || ??? || ? || <center>X</center> ||
|-
| wtv-send-thumbnail-size || ??? || ??? || ? || <center>X</center> ||
|-
| wtv-send-thumbnail-to || ??? || ??? || ? || <center>X</center> ||
|-
| [[WTVP/Headers/wtv-service|wtv-service]] || Defines the services supported by the WebTV/MSN TV service, the IP addresses and corresponding ports they resided on, property flags, and the maximum connections that can be made from a service || string || Yes || <center>X</center> ||
|-
| wtv-service-cookie || Sent by server on successful login. Also possibly sent by the client. Need more documentation on this || BLOB || No || <center>X</center> || <center>X</center>
|-
| wtv-service-data || Appears to be an XML string with information on the user currently logged in. Only observed when logging on through Microsoft TV services || string || No || <center>X</center> ||
|-
| wtv-service-message || ??? || ??? || ? || <center>X</center> ||
|-
| wtv-service-timeout || ??? || ??? || ? || <center>X</center> ||
|-
| wtv-settings-url || Contains a service URL to the settings service, which sends the client the server-side settings for the currently logged-in user. Value currently observed as <code>wtv-setup:/get-settings</code>. Need more documentation on this || URL || No || <center>X</center> ||
|-
| wtv-show-time || Values observed are "0" and "3". Function unknown. Contrary to eMac's write-up, this header doesn't seem to appear in server responses, and so far has only been observed in service requests. || ??? || No || || <center>X</center>
|-
| wtv-show-time-enabled || Value currently observed as "true". Function unknown. || boolean || No || <center>X</center> ||
|-
| wtv-show-time-record || ??? || ??? || ? || <center>X</center> ||
|-
| wtv-smartcard-inserted-message || Related to the (rarely utilized) WebTV/MSN TV smartcard feature. Value currently observed as "Contacting service". Need more documentation on this || string || No || <center>X</center> ||
|-
| wtv-smartcard-inserted-url || Related to the (rarely utilized) WebTV/MSN TV smartcard feature. Value currently observed as <code>wtv-smartcard:/insert</code>. WebTV Classic boxes require this header for inserted smartcards to function. Need more documentation on this || URL || No || <center>X</center> ||
|-
| wtv-smartcard-removed-url || Related to the (rarely utilized) WebTV/MSN TV smartcard feature. Value currently observed as <code>wtv-smartcard:/remove</code>. Need more documentation on this || URL || No || <center>X</center> ||
|-
| wtv-spot || ??? || ??? || ? || <center>X</center> ||
|-
| wtv-spotad-url || Contains a service URL. Value currently observed as <code>wtv-spot:/get-ad</code>. Function unknown || URL || No || <center>X</center> ||
|-
| wtv-spot-clickthru-url || Contains a service URL. Values observed are <code>wtv-spot:/ad-clickthrough?ad-click-ref=%s</code> and <code>wtv-spot:/clkURL/%s</code>. Function unknown || URL || ? || <center>X</center> ||
|-
| wtv-spot-directive || ??? || ??? || ? || <center>X</center> ||
|-
| wtv-spot-doze || ??? || ??? || ? || <center>X</center> ||
|-
| wtv-spot-duty-cycle || ??? || ??? || ? || <center>X</center> ||
|-
| wtv-spot-impression-time || ??? || integer || No || <center>X</center> ||
|-
| wtv-spot-minimum-time || ??? || integer || No || <center>X</center> ||
|-
| wtv-spot-purge-queue || Probably does something with the WebTV/MSN TV box cache. Need more documentation on this || integer || Yes || <center>X</center> ||
|-
| wtv-spot-queue-add || Value currently observed as <code>queue=1&adID=0000001102cbda8500000000&creative=[xxxxx]</code>. Function unknown || string || ? || <center>X</center> ||
|-
| wtv-spot-url || Contains a service URL. Value currently observed as <code>wtv-spot:/spot</code>. Function unknown || URL || No || <center>X</center> ||
|-
| wtv-ssl-certs-checksum || Contains a checksum possibly related to the certificate download defined by the <code>wtv-ssl-certs-download-url</code> header. Judging from the checksum length it's probably meant to be MD5. Need more documentation on this || string || No || <center>X</center> ||
|-
| wtv-ssl-certs-download-url || Contains a service URL. Possibly used to allow the client to download new SSL root certificates. Value currently observed as <code>wtv-head-waiter:/download-ssl-certs</code> || URL || No || <center>X</center> ||
|-
| wtv-ssl-log-url || Contains a service URL. Value currently observed as <code>wtv-log:/log</code>. Most likely used for usage logging || URL || No || <center>X</center> ||
|-
| wtv-ssl-timeout || Value currently observed as "240". Function unknown || integer || No || <center>X</center> ||
|-
| wtv-start-at-tourist-page || ??? || ??? || ? || <center>X</center> ||
|-
| wtv-system-chipversion || ??? || integer || No || || <center>X</center>
|-
| wtv-system-cpuspeed || Probably has to do with CPU speed but if that's the case, it's not known how it's measured || integer || No || || <center>X</center>
|-
| wtv-system-sysconfig || ??? || integer || No || || <center>X</center>
|-
| wtv-system-version || ??? || integer || No || <center>X</center> || <center>X</center>
|-
| wtv-tcp-log-url || Possibly related to the other "log-url" headers, but no known documentation of this header in particular is out in the wild || ??? || ? || <center>X</center> ||
|-
| wtv-ticket || An opaque blob value sent in WebTV/MSN TV service requests to verify sessions after login. Also known to be sent to a box during headwaiter login || BLOB || No || <center>X</center> || <center>X</center>
|-
| wtv-title || Used to specify the title in files that don't normally have them. Can be used in the headers of a service response or as a query for a file (e.g: <code>http://somesite.com/midi.mid?wtv-title=sometitle)</code> || ??? || ? || <center>X</center> ||
|-
| wtv-tmp-filesystem || Used to specify a location for a new ROMFS container to be downloaded by the client. This will be provided by the server when the client knows its ROMFS is damaged. || URL || Yes || <center>X</center> ||
|-
| wtv-tourist-active || ??? || ??? || ? || <center>X</center> ||
|-
| wtv-tourist-enabled || ??? || boolean || No || <center>X</center> ||
|-
| wtv-transition || Only observed in packet captures when browsing between service pages. Currently observed values are "light" and "none". Function unknown || string || ? || <center>X</center> ||
|-
| wtv-transition-override || Values currently observed are "normal" and "off". Function unknown || string || ? || <center>X</center> ||
|-
| wtv-transition-page || Value currently observed as <code>wtv-home:/shared/transition/en-US/pageWithAd.html</code>. Function unknown || URL || ? || <center>X</center> ||
|-
| wtv-transition-page-noad || ??? || ??? || ? || <center>X</center> ||
|-
| wtv-trusted || Used to set trust on pages. For some reason, this header will distrust any page it gets sent with, regardless of if it's set to true or false. || boolean || ? || <center>X</center> ||
|-
| wtv-tvconnection-timeout || Value currently observed as "600". Function unknown || integer || ? || <center>X</center> ||
|-
| wtv-tv-vbidisable || VBI = Vertical Blanking Interval? Function unknown || ??? || ? || <center>X</center> ||
|-
| wtv-tv-zipcode || Contains user's ZIP code, but probably isn't used by the service itself. Need more documentation on this || integer || No || <center>X</center> ||
|-
| wtv-user-id || Probably similar to the <code>user-id</code> header. Need more documentation on this || ??? || No || <center>X</center> ||
|-
| wtv-user-inactive-warning-time || ??? || ??? || ? || <center>X</center> ||
|-
| wtv-user-name || Username associated with WebTV/MSN TV account || string || No || <center>X</center> ||
|-
| wtv-user-requested-upgrade || ??? || ??? || ? || <center>X</center> ||
|-
| wtv-videoad-path || ??? || ??? || ? || <center>X</center> ||
|-
| wtv-videoad-playid || Value currently observed as a hexadecimal string. Function unknown || string || ? || <center>X</center> ||
|-
| wtv-videoad-playname || Value currently observed as a file name ending in ".mpg". Function unknown || string || ? || <center>X</center> ||
|-
| wtv-visit || WTVP's own version of the HTTP <code>Location</code> header used mainly to route the WebTV/MSN TV box to other service URLs on non-3xx responses || URL || Yes || <center>X</center> ||
|-
| wtv-zipcode || ZIP code of WebTV/MSN TV account || integer || No || <center>X</center> ||
|}

WTVP/Headers/List

2023-08-11T20:51:23Z

Wtv-411: Add Approx-Content-Length

{{WTVPNav}}

List of known recorded WTVP headers. Most have been copied from http://web.archive.org/web/20041026232010/http://ubergeek03.mine.nu/WebTV/WebTVPHeaders.html, but we've contributed some previously unknown headers we've been able to observe, along with adding descriptions and command header classifications for all headers.

Got any information you'd like to contribute to this? [[Wanted|Send it over to us]] and it might be added onto here.

{| class="wikitable"
! Header Name !! Description !! Type !! [[WTVP#Command_Headers|Command Header?]] !! Server? !! Client?
|-
| Accept-Language || Standard HTTP header || string || No || || <center>X</center>
|-
| Connection || Standard HTTP header. WTVP was designed with persistent connections in mind, but official WNI servers have been seen sending a <code>Keep-Alive</code> Connection header in responses nonetheless || string || No || <center>X</center> ||
|-
| Content-length || Standard HTTP header || integer || No || <center>X</center> || <center>X</center>
|-
| Content-type || Standard HTTP header || string || No || <center>X</center> || <center>X</center>
|-
| Date || Standard HTTP header. Probably only present when connecting through Microsoft TV services || timestamp || No || <center>X</center> ||
|-
| Expires || Standard HTTP header || timestamp || No || <center>X</center> ||
|-
| User-Agent || Standard HTTP header || string || No || || <center>X</center>
|-
| Approx-Content-Length || Sent in some responses from the WebTV/MSN TV web proxies. Contains the length of the original data for the queried resource before being sent as multipart data || integer || No || <center>X</center> ||
|-
| mstv-checkurl-mode || Value currently observed as "1". Only seen when connecting through Microsoft TV services. Function unknown || ??? || ? || <center>X</center> ||
|-
| mstv-client-caps || Only seen when connecting through Microsoft TV services. Function unknown || ??? || ? || || <center>X</center>
|-
| mstv-listing-id || Value currently observed as "C1020". Only seen when connecting through Microsoft TV services. Function unknown || string || ? || <center>X</center> ||
|-
| smartcard-data || When connecting to the WebTV/MSN TV service with a compatible smart card inserted, a box will send this header in WTVP requests with the raw smart card data. || string || No || || <center>X</center>
|-
| passport-domain || Domain name of the Passport account (now Microsoft account) linked to the current WebTV/MSN TV subscriber/user account || string || No || <center>X</center> ||
|-
| user-id || Appears to be a long string of numbers || integer || No || <center>X</center> ||
|-
| wtv-addresses-url || Contains a service URL for listing all the user's stored addresses. Addresses are sent with the name, followed by a null byte, then the address with another null byte at the end. This is used for the Address panel. Value currently observed as <code>wtv-mail:/addresslist</code>. || URL || No || <center>X</center> ||
|-
| wtv-ahuf || ??? || ??? || ? || <center>X</center> ||
|-
| wtv-allow-dsc || Value currently observed as "true". Function unknown || boolean || No || <center>X</center> ||
|-
| wtv-backgroundmusic-add || Specifies sound files as selected by the subscriber/user to add to the background music queue || URL || Yes || <center>X</center> ||
|-
| wtv-backgroundmusic-clear || Apparently clears backlog of predefined background music to play. Value currently observed as "no_zits" || string || Yes || <center>X</center> ||
|-
| wtv-backgroundmusic-load-playlist || Sets a service URL for the client to query to get the list of background music for the user currently logged in. This header is known to be sent in the response for the [[WTVP/Processes/Retrieving settings|settings service]]. Value currently observed as <code>wtv-setup:/load-playlist</code> || URL || No || <center>X</center> ||
|-
| wtv-backgroundmusic-remove || Probably similar to wtv-backgroundmusic-add but for removing queued background music || ??? || ? || <center>X</center> ||
|-
| wtv-boot-message-led-state || Sets the state of the message light. Value currently observed as "blinkSlow". Need more documentation on this || string || ? || <center>X</center> ||
|-
| wtv-boot-url || Value currently observed as <code>wtv-head-waiter:/login?</code>. Need more documentation on this || URL || No || <center>X</center> ||
|-
| wtv-bypass-proxy || ??? || boolean || No || <center>X</center> ||
|-
| wtv-capability-flags || A hexadecimal string that [[Capability Flags|identifies the capabilities of a WebTV/MSN TV client]], and affects how the service functions on it. Need more documentation on this || string || No || || <center>X</center>
|-
| wtv-ccs || ??? || ??? || ? || <center>X</center> ||
|-
| wtv-challenge || A structured BLOB value that's sent by the server during the headwaiter login stage. Starts the [[WTVP/Processes/Headwaiter#Challenge/Response|challenge/response process]]. When decrypted, it contains random "challenge data" that has to be sent back in the challenge response, along with two sessions keys needed to facilitate <code>SECURE</code> communication, among other data. || BLOB || No || <center>X</center> ||
|-
| wtv-challenge-response || Used during the headwaiter [[WTVP/Processes/Headwaiter#Challenge/Response|challenge/response process]] to respond to the challenge with another structured BLOB value that is verified by the server. Sends back the "challenge data" from the wtv-challenge encrypted with the initial key. || BLOB || No || || <center>X</center>
|-
| wtv-check-url || ??? || ??? || ? || <center>X</center> ||
|-
| wtv-clickthru-redirect || ??? || ??? || ? || <center>X</center> ||
|-
| wtv-client-address || Has an IP address of sorts, presumably of the box connecting to the server || string || No || || <center>X</center>
|-
| wtv-client-bootrom-version || An integer that identifies... the boot ROM version? || integer || No || || <center>X</center>
|-
| wtv-client-date || Human-readable timestamp in GMT, most likely the date of when the subscriber/user successfully logged on. Need more documentation on this || timestamp || No || <center>X</center> ||
|-
| wtv-client-rom-type || Identifies the ROM type a WebTV/MSN TV box is running || string || No || || <center>X</center>
|-
| wtv-client-serial-number || [[Silicon Serial ID|SSID]] of the WebTV/MSN TV box - identifies who is sending a WTVP request || string || No || || <center>X</center>
|-
| wtv-client-time-zone || Time zone that corresponds to the user's current location, in both name and offset (e.g., "PDT -0700"). It is speculated that this value is determined on the service side by using the user's ANI number when a box dials into the toll-free access number || string || No || <center>X</center> ||
|-
| wtv-connection-timeout || Value currently observed as "90". Function unknown || integer || No || <center>X</center> ||
|-
| wtv-connect-session-id || Some hexadecimal value we can't figure out the purpose of. Function unknown || string || No || || <center>X</center>
|-
| wtv-country || Two-letter country code. Most of the time it's just set to "US" though. Need more documentation on this || string || No || <center>X</center> ||
|-
| wtv-datadownload-checktimeoffset || ??? || integer || No || <center>X</center> ||
|-
| wtv-datadownload-login-url || Contains the URL the box accesses when connecting for DataDownload. Value currently observed as wtv-head-waiter:/login?DataDownload=1. Also used to unlock TV Home on WebTV Plus boxes and change the offline home page on WebTV Dreamcast. || URL || No || <center>X</center> ||
|-
| wtv-datadownload-url || Contains a service URL. Value currently observed as <code>wtv-disk:/download-list</code>. Function unknown || URL || No || <center>X</center> ||
|-
| wtv-demo-mode || Value currently observed as "0". Function unknown || integer || No || <center>X</center> || <center>X</center>
|-
| wtv-doug || ??? || ??? || ? || <center>X</center> ||
|-
| wtv-echostar-ca || Unknown function. Value observed as "0x0" || ??? || ? || || <center>X</center>
|-
| wtv-echostar-receiver || Unknown function. Value observed as "R0022040763-84" || ??? || ? || || <center>X</center>
|-
| wtv-echostar-rom || Unknown function. Value observed as "121PBWDA-F-100BBWDA" || ??? || ? || || <center>X</center>
|-
| wtv-echostar-smartcard || Unknown function. Value observed as "S0004596155-62-DNASP003 Rev381" || ??? || ? || || <center>X</center>
|-
| wtv-edit-addresses-url || Specifies the URL used for the "Edit Addresses" button in the Address panel. || ??? || ? || <center>X</center> ||
|-
| wtv-element-logging || Sent in the post-login headwaiter response (for BPS/New Classic boxes at least). Unknown function. Value observed as <code>60 1</code> || ??? || ? || <center>X</center> ||
|-
| wtv-enable-jellyscript || ??? || ??? || ? || <center>X</center> ||
|-
| wtv-encrypted || Sent by the server most likely to tell the WebTV/MSN TV box if a response is encrypted || boolean || No || <center>X</center> ||
|-
| wtv-encryption || Tells the server if the WebTV/MSN TV box can understand encrypted communication (<code>SECURE</code> method?). Resulting behavior unknown || boolean || No || || <center>X</center>
|-
| wtv-execute-tellyscript-now || ??? || ??? || ? || <center>X</center> ||
|-
| wtv-expire || Expires the specified page in the box's page cache. || ??? || ? || <center>X</center> ||
|-
| wtv-expire-all || Similar to wtv-expire, but expires all assets for a page as well. Is also used to expire entire page types in some cases (e.g: wtv-expire-all: wtv-) || URL || Yes || <center>X</center> ||
|-
| wtv-explanation-url || Only observed in error responses. Contains a service URL that so far is only known to point to the <code>wtv-guide</code> service. Most likely used to give the subscriber/user a page describing the error they encountered || URL || No || <center>X</center> ||
|-
| wtv-explore-url || Contains a service URL. Value currently observed as <code>wtv-explore2:/top</code>. Function unknown || URL || No || <center>X</center> ||
|-
| wtv-fader-timeout || Value currently observed as "900". Function unknown || integer || No || <center>X</center> ||
|-
| wtv-favorite-index-url || Contains a service URL related to the <code>wtv-favorite</code> service. Used for the F keys on the keyboard. Value currently observed as <code>wtv-favorite:/favorite-index?</code> || URL || No || <center>X</center> ||
|-
| wtv-favorites-folders-url || Contains a service URL related to the <code>wtv-favorite</code> service. Used for the list of favorites on the save panel. Value currently observed as <code>wtv-favorite:/list-folders</code> || URL || No || <center>X</center> ||
|-
| wtv-favorite-url || Contains a service URL related to the <code>wtv-favorite</code> service. This is used to define the Favorites page that should be used for the "Favs" button on the keyboard. Value currently observed as <code>wtv-favorite:/favorite</code> || URL || No || <center>X</center> ||
|-
| wtv-field-name || Appears to contain the name of another WTVP header or variable sent in a <code>POST</code> request. Possibly used for detailing protocol errors. Need more documentation on this || string || ? || <center>X</center> ||
|-
| wtv-filter || ??? || ??? || ? || <center>X</center> ||
|-
| wtv-force-heavyweight-targets || ??? || ??? || ? || <center>X</center> ||
|-
| wtv-force-lightweight-targets || Value currently observed as <code>webtv.net:/</code>. Function unknown || string || ? || <center>X</center> ||
|-
| wtv-goto-url || ??? || ??? || ? || <center>X</center> ||
|-
| wtv-home-url || Contains the service URL designated to be the service home page. Value currently observed as <code>wtv-home:/home</code> || URL || No || <center>X</center> ||
|-
| wtv-https-proxy || ??? || ??? || ? || <center>X</center> ||
|-
| wtv-human-name || First and last name specified on a subscriber/user account || string || No || <center>X</center> ||
|-
| wtv-inactive-timeout || Value currently observed as "0". Function unknown || integer || No || <center>X</center> ||
|-
| wtv-incarnation || A counter sent and incremented on each first connection to a frontend server. This is needed to create the encryption key for <code>SECURE</code> communication. || integer || No || || <center>X</center>
|-
| wtv-initial-key || A small opaque, 8-byte BLOB sent during pre-registration. Facilitates [[WTVP/Processes/Headwaiter#Challenge/Response|challenge/response]] on the headwaiter. || BLOB || No || <center>X</center> ||
|-
| wtv-input-timeout || Values currently observed are "86400" and "14400". Function unknown || integer || ? || <center>X</center> ||
|-
| wtv-irc-nick || IRC nickname defined on subscriber/user account for usage with WebTV/MSN TV IRC services || string || No || <center>X</center> ||
|-
| wtv-language-header || Value currently observed as "en-US,en". Function unknown || string || No || <center>X</center> ||
|-
| wtv-link-transition-enabled || ??? || ??? || ? || <center>X</center> ||
|-
| wtv-location || ??? || ??? || ? || <center>X</center> ||
|-
| wtv-lockpage-override || ??? || ??? || ? || <center>X</center> ||
|-
| wtv-login-timeout || Value currently observed as "7200". Function unknown || integer || No || <center>X</center> ||
|-
| wtv-logo-duration || ??? || ??? || ? || <center>X</center> ||
|-
| wtv-logo-input-interval || ??? || ??? || ? || <center>X</center> ||
|-
| wtv-logo-interval || ??? || ??? || ? || <center>X</center> ||
|-
| wtv-logon || ??? || ??? || ? || <center>X</center> ||
|-
| wtv-logout-url || Contains a service URL designated for logout probably. Value currently observed as <code>wtv-logon:/logout</code>. Only seen when connecting through Microsoft TV services || URL || No || <center>X</center> ||
|-
| wtv-log-url || Contains a service URL designated for usage logging services || URL || No || <center>X</center> ||
|-
| wtv-lzpf || Observed in headers of encrypted/compressed responses. Usually has a value of 0. If present, the client uses the Huffman-based "LZPF" algorithm to decompress response data. || integer || No || <center>X</center> ||
|-
| wtv-mail-count || Stores how many unread messages the user has. If a client accesses a headwaiter service without selecting an account to log into, this header contains the total of all unread mail for all users, otherwise it only has unread mail for the currently signed in user. This also controls the message light. || integer || No || <center>X</center> ||
|-
| wtv-mail-url || Contains a service URL designated for mail service. Value currently observed as <code>wtv-mail:/listmail</code> || URL || No || <center>X</center> ||
|-
| wtv-messagewatch-checktimeoffset || Offset in seconds since midnight for [[WTVP/Processes/MessageWatch|MessageWatch]] activation. || integer || ? || <center>X</center> ||
|-
| wtv-messagewatch-url || Contains a service URL for the client to log in to on MessageWatch connections. Value currently observed as <code>wtv-head-waiter:/login?MessageWatch=1</code> || URL || No || <center>X</center> ||
|-
| wtv-messenger-authorized || Tells the box if the subscriber/user is authorized to use the Messenger feature. 1 - authorized; 0 - not authorized || integer || No || <center>X</center> ||
|-
| wtv-messenger-connect-timeout || Value currently observed as "240". Function unknown || integer || No || <center>X</center> ||
|-
| wtv-messenger-enable || Tells the box if the subscriber/user has the Messenger feature enabled. 1 - enabled; 0 - disabled || integer || No || <center>X</center> ||
|-
| wtv-messenger-login-url || Defines what service URL should be accessed for [[Services/Technical/Messenger#WTVP|Messenger login]]. Value currently observed as <code>wtv-passport:/messengerlogin</code> || URL || No || <center>X</center> ||
|-
| wtv-messenger-open-conversation-timeout || Value currently observed as "240". Function unknown || integer || No || <center>X</center> ||
|-
| wtv-messenger-passportd-timeout || Value currently observed as "240". Function unknown || integer || No || <center>X</center> ||
|-
| wtv-messenger-retry-timeout || Value currently observed as "20". Function unknown || integer || No || <center>X</center> ||
|-
| wtv-messenger-server || Defines what hostname the client should use for accessing the [[Services/Technical/Messenger|Messenger service]]. The servers this would point to were a part of the MSN/Windows Live Messenger service, a completely different service that happened to be owned by Microsoft, and is completely separate from WebTV/MSN TV || string || No || <center>X</center> ||
|-
| wtv-metering-pricing || Enables or disables [[Metering protocol|metering services]] for a supported WebTV/MSN TV build || boolean || No || <center>X</center> ||
|-
| wtv-metering-pricing-interval || Sets the time interval in seconds that WebTV/MSN TV should wait in between contacting the Metering server || integer || No || <center>X</center> ||
|-
| wtv-metering-pricing-sessionID || A 30-byte session ID WebTV/MSN TV should use when contacting the Metering server || string || No || <center>X</center> ||
|-
| wtv-metering-pricing-track-as-free || Related to metering. Function unknown || boolean || No || <center>X</center> ||
|-
| wtv-moviesearch-url || Contains a service URL designated for "moviesearch" - probably some ancillary and completely useless feature. Value currently observed as <code>wtv-content:/redirect?req-id=find-movie</code> || URL || No || <center>X</center> ||
|-
| wtv-msnchat-nick || The nickname used for accessing [https://en.wikipedia.org/wiki/MSN_Chat MSN Chat] services within WebTV/MSN TV. It appears to be similar to the value of the <code>wtv-irc-nick</code> header but with a ">" tacked onto the beginning of it (e.g., ">wtv-nick") || string || No || <center>X</center> ||
|-
| wtv-name-server || Defines an IP to use for DNS lookup. Probably not a command header, but multiple instances of this header can exist to define multiple DNS servers || string || No || <center>X</center> ||
|-
| wtv-next-reconnect-url || ??? || ??? || ? || <center>X</center> ||
|-
| wtv-noads-targets || ??? || ??? || ? || <center>X</center> ||
|-
| wtv-noback || ??? || ??? || ? || <center>X</center> ||
|-
| wtv-noback-all || Similar to wtv-noback, but can be used to disallow all of one page type (e.g: <code>wtv-noback-all: wtv-</code>). Value currently observed as "wtv-" || string || ? || <center>X</center> ||
|-
| wtv-notifications-url || The URL that a box should contact when it receives a UDP notification from [[Mail Notify]]. Value currently observed as <code>wtv-notices:/notices</code> || URL || No || <center>X</center> ||
|-
| wtv-nvstorage-dump || URL to a WTVP service that saves a box's NVRAM (flash memory) data. When this header is present in a WTVP server response, the box will immediately POST to the service URL set in the header with a portion of data from NVRAM, which includes [[TellyScript]] data stored by the box. This header will only work on builds for Old Classic (bf0app) boxes. Original URL was likely <code>wtv-1800:/post-nvstorage-dump</code> || URL || No || <center>X</center> ||
|-
| [[WTVP/Headers/wtv-offline-user-list|wtv-offline-user-list]] || Base64-encoded string. When decoded, it reveals an XML string containing a list of users a WebTV/MSN TV subscriber currently has, including their user ID, username, first/last name, password, and if they have access to mail services. Need more documentation on this || string || No || <center>X</center> ||
|-
| wtv-open-access || ??? || ??? || ? || <center>X</center> ||
|-
| wtv-open-isp-disabled || Value currently observed as "false". Function unknown || boolean || No || <center>X</center> ||
|-
| wtv-phone-log-url || Contains a service URL. Values currently observed are <code>wtv-log:/phone-log</code> on successful login, and a URL along the lines of <code>wtv-1800:/post-phone-log?t-baggage-parms=ani-950000000000,ethernet-ani-4156145500,subscriber-id-14331444</code>. It's been observed when the header is present in a response, on a WebTV Viewer at least, it will immediately query said service. Most likely used for usage logging || URL || No || <center>X</center> ||
|-
| wtv-preregistration-number || ??? || ??? || ? || <center>X</center> ||
|-
| wtv-printer-model || Value currently observed as "-1,-1". Function unknown || string || ? || <center>X</center> ||
|-
| wtv-printer-pen || Value currently observed as "0,0,1,0". Function unknown || string || ? || <center>X</center> ||
|-
| wtv-printer-setup || Value currently observed as "0,0,1,0". Function unknown || string || ? || <center>X</center> ||
|-
| wtv-print-log-url || Contains a service URL. Value currently observed as <code>wtv-log:/log</code>. Most likely used for usage logging || URL || No || <center>X</center> ||
|-
| wtv-reconnect-url || Specifies the URL the box should access when reconnecting with the Reconnect panel. || URL || ? || <center>X</center> ||
|-
| wtv-reload || ??? || ??? || ? || <center>X</center> ||
|-
| wtv-reload-all || ??? || ??? || ? || <center>X</center> ||
|-
| wtv-relogin-url || ??? || URL || No || <center>X</center> ||
|-
| wtv-rename-url || ??? || ??? || ? || <center>X</center> ||
|-
| wtv-request-rom-upgrade || ??? || ??? || ? || || <center>X</center>
|-
| wtv-request-type || Known values observed are "primary" and "prefetch". Function unknown || string || No || <center>X</center> || <center>X</center>
|-
| wtv-script-id || Carries the "hash1" value from an installed [[TellyScript]] on the WebTV/MSN TV client, or defaults to 0 if one isn't present || integer || No || || <center>X</center>
|-
| wtv-script-mod || Carries the creation time (UNIX epoch) from an installed [[TellyScript]] on the WebTV/MSN TV client, or defaults to 0 if one isn't present || integer || No || || <center>X</center>
|-
| wtv-search-url || Contains a service URL most likely designated for the search page. Value currently observed as <code>wtv-center:/search-page</code> || URL || No || <center>X</center> ||
|-
| wtv-send-thumbnail-from || ??? || ??? || ? || <center>X</center> ||
|-
| wtv-send-thumbnail-size || ??? || ??? || ? || <center>X</center> ||
|-
| wtv-send-thumbnail-to || ??? || ??? || ? || <center>X</center> ||
|-
| [[WTVP/Headers/wtv-service|wtv-service]] || Defines the services supported by the WebTV/MSN TV service, the IP addresses and corresponding ports they resided on, property flags, and the maximum connections that can be made from a service || string || Yes || <center>X</center> ||
|-
| wtv-service-cookie || Sent by server on successful login. Also possibly sent by the client. Need more documentation on this || BLOB || No || <center>X</center> || <center>X</center>
|-
| wtv-service-data || Appears to be an XML string with information on the user currently logged in. Only observed when logging on through Microsoft TV services || string || No || <center>X</center> ||
|-
| wtv-service-message || ??? || ??? || ? || <center>X</center> ||
|-
| wtv-service-timeout || ??? || ??? || ? || <center>X</center> ||
|-
| wtv-settings-url || Contains a service URL to the settings service, which sends the client the server-side settings for the currently logged-in user. Value currently observed as <code>wtv-setup:/get-settings</code>. Need more documentation on this || URL || No || <center>X</center> ||
|-
| wtv-show-time || Values observed are "0" and "3". Function unknown. Contrary to eMac's write-up, this header doesn't seem to appear in server responses, and so far has only been observed in service requests. || ??? || No || || <center>X</center>
|-
| wtv-show-time-enabled || Value currently observed as "true". Function unknown. || boolean || No || <center>X</center> ||
|-
| wtv-show-time-record || ??? || ??? || ? || <center>X</center> ||
|-
| wtv-smartcard-inserted-message || Related to the (rarely utilized) WebTV/MSN TV smartcard feature. Value currently observed as "Contacting service". Need more documentation on this || string || No || <center>X</center> ||
|-
| wtv-smartcard-inserted-url || Related to the (rarely utilized) WebTV/MSN TV smartcard feature. Value currently observed as <code>wtv-smartcard:/insert</code>. WebTV Classic boxes require this header for inserted smartcards to function. Need more documentation on this || URL || No || <center>X</center> ||
|-
| wtv-smartcard-removed-url || Related to the (rarely utilized) WebTV/MSN TV smartcard feature. Value currently observed as <code>wtv-smartcard:/remove</code>. Need more documentation on this || URL || No || <center>X</center> ||
|-
| wtv-spot || ??? || ??? || ? || <center>X</center> ||
|-
| wtv-spotad-url || Contains a service URL. Value currently observed as <code>wtv-spot:/get-ad</code>. Function unknown || URL || No || <center>X</center> ||
|-
| wtv-spot-clickthru-url || Contains a service URL. Values observed are <code>wtv-spot:/ad-clickthrough?ad-click-ref=%s</code> and <code>wtv-spot:/clkURL/%s</code>. Function unknown || URL || ? || <center>X</center> ||
|-
| wtv-spot-directive || ??? || ??? || ? || <center>X</center> ||
|-
| wtv-spot-doze || ??? || ??? || ? || <center>X</center> ||
|-
| wtv-spot-duty-cycle || ??? || ??? || ? || <center>X</center> ||
|-
| wtv-spot-impression-time || ??? || integer || No || <center>X</center> ||
|-
| wtv-spot-minimum-time || ??? || integer || No || <center>X</center> ||
|-
| wtv-spot-purge-queue || Probably does something with the WebTV/MSN TV box cache. Need more documentation on this || integer || Yes || <center>X</center> ||
|-
| wtv-spot-queue-add || Value currently observed as <code>queue=1&adID=0000001102cbda8500000000&creative=[xxxxx]</code>. Function unknown || string || ? || <center>X</center> ||
|-
| wtv-spot-url || Contains a service URL. Value currently observed as <code>wtv-spot:/spot</code>. Function unknown || URL || No || <center>X</center> ||
|-
| wtv-ssl-certs-checksum || Contains a checksum possibly related to the certificate download defined by the <code>wtv-ssl-certs-download-url</code> header. Judging from the checksum length it's probably meant to be MD5. Need more documentation on this || string || No || <center>X</center> ||
|-
| wtv-ssl-certs-download-url || Contains a service URL. Possibly used to allow the client to download new SSL root certificates. Value currently observed as <code>wtv-head-waiter:/download-ssl-certs</code> || URL || No || <center>X</center> ||
|-
| wtv-ssl-log-url || Contains a service URL. Value currently observed as <code>wtv-log:/log</code>. Most likely used for usage logging || URL || No || <center>X</center> ||
|-
| wtv-ssl-timeout || Value currently observed as "240". Function unknown || integer || No || <center>X</center> ||
|-
| wtv-start-at-tourist-page || ??? || ??? || ? || <center>X</center> ||
|-
| wtv-system-chipversion || ??? || integer || No || || <center>X</center>
|-
| wtv-system-cpuspeed || Probably has to do with CPU speed but if that's the case, it's not known how it's measured || integer || No || || <center>X</center>
|-
| wtv-system-sysconfig || ??? || integer || No || || <center>X</center>
|-
| wtv-system-version || ??? || integer || No || <center>X</center> || <center>X</center>
|-
| wtv-tcp-log-url || Possibly related to the other "log-url" headers, but no known documentation of this header in particular is out in the wild || ??? || ? || <center>X</center> ||
|-
| wtv-ticket || An opaque blob value sent in WebTV/MSN TV service requests to verify sessions after login. Also known to be sent to a box during headwaiter login || BLOB || No || <center>X</center> || <center>X</center>
|-
| wtv-title || Used to specify the title in files that don't normally have them. Can be used in the headers of a service response or as a query for a file (e.g: <code>http://somesite.com/midi.mid?wtv-title=sometitle)</code> || ??? || ? || <center>X</center> ||
|-
| wtv-tmp-filesystem || Used to specify a location for a new ROMFS container to be downloaded by the client. This will be provided by the server when the client knows its ROMFS is damaged. || URL || Yes || <center>X</center> ||
|-
| wtv-tourist-active || ??? || ??? || ? || <center>X</center> ||
|-
| wtv-tourist-enabled || ??? || boolean || No || <center>X</center> ||
|-
| wtv-transition || Only observed in packet captures when browsing between service pages. Currently observed values are "light" and "none". Function unknown || string || ? || <center>X</center> ||
|-
| wtv-transition-override || Values currently observed are "normal" and "off". Function unknown || string || ? || <center>X</center> ||
|-
| wtv-transition-page || Value currently observed as <code>wtv-home:/shared/transition/en-US/pageWithAd.html</code>. Function unknown || URL || ? || <center>X</center> ||
|-
| wtv-transition-page-noad || ??? || ??? || ? || <center>X</center> ||
|-
| wtv-trusted || Used to set trust on pages. For some reason, this header will distrust any page it gets sent with, regardless of if it's set to true or false. || boolean || ? || <center>X</center> ||
|-
| wtv-tvconnection-timeout || Value currently observed as "600". Function unknown || integer || ? || <center>X</center> ||
|-
| wtv-tv-vbidisable || VBI = Vertical Blanking Interval? Function unknown || ??? || ? || <center>X</center> ||
|-
| wtv-tv-zipcode || Contains user's ZIP code, but probably isn't used by the service itself. Need more documentation on this || integer || No || <center>X</center> ||
|-
| wtv-user-id || Probably similar to the <code>user-id</code> header. Need more documentation on this || ??? || No || <center>X</center> ||
|-
| wtv-user-inactive-warning-time || ??? || ??? || ? || <center>X</center> ||
|-
| wtv-user-name || Username associated with WebTV/MSN TV account || string || No || <center>X</center> ||
|-
| wtv-user-requested-upgrade || ??? || ??? || ? || <center>X</center> ||
|-
| wtv-videoad-path || ??? || ??? || ? || <center>X</center> ||
|-
| wtv-videoad-playid || Value currently observed as a hexadecimal string. Function unknown || string || ? || <center>X</center> ||
|-
| wtv-videoad-playname || Value currently observed as a file name ending in ".mpg". Function unknown || string || ? || <center>X</center> ||
|-
| wtv-visit || WTVP's own version of the HTTP <code>Location</code> header used mainly to route the WebTV/MSN TV box to other service URLs on non-3xx responses || URL || Yes || <center>X</center> ||
|-
| wtv-zipcode || ZIP code of WebTV/MSN TV account || integer || No || <center>X</center> ||
|}

WTVP/Services/wtv-customscript/URLs

2023-08-11T18:13:19Z

Wtv-411: Correct description for benchmark-image

{{WTVPNav}}

URLs for wtv-customscript WTVP service.

{| class="wikitable"
! URL || Description || Methods Supported || wtv-token Present? || Notes
|-
| wtv-customscript:/vendatelly || "Vend-a-Telly" - offers services for generating and loading custom [[TellyScript|TellyScripts]]. Provides the options of pre-made TellyScripts or building one from scratch || GET || Yes ||
|-
| wtv-customscript:/tellyscript || Generates a custom TellyScript based on user-provided options. Need more documentation on this || GET || Yes || E.g., "wtv-customscript:/tellyscript-wtv-token-1648397422-47E5638DB31376C109EB94C94EFA169C?provider=cnc&number=2522113" - generates a TellyScript that dials CNC from number 252-2113 (Lexington, KY)
|-
| wtv-customscript:/benchmark-image || Downloads a test image for benchmarking POP connection speeds. Need more documentation on this || GET || Yes ||
|-
| wtv-customscript:/benchmark-test-result || Shows results of "benchmark-image" test. Need more documentation on this || ??? || Yes ||
|-
| wtv-customscript:/poptour-guide || "Der PopTourSchnitzel" - stress tests POP numbers || GET || Yes ||
|-
| wtv-customscript:/poptour-choose-pop || Page to specify which POP number to "pummel to a bloody pulp" (stress test) || GET || Yes ||
|-
| wtv-customscript:/poptour-pound-selected-pop || ??? || GET || Yes ||
|-
| wtv-customscript:/jiffy-pop-o-rama || Phone number lookup. Need more documentation on this || GET || Yes ||
|-
| wtv-customscript:/poptour || "Tour de POP" - stress tests 8,302(?) POP numbers, possibly more. Need more documentation on this || GET || Yes ||
|-
| wtv-customscript:/poptour?fixed=NNNN || Individual POP number test. Need more documentation on this || GET || Yes ||
|}

WTVP/Services/wtv-favorite/URLs

2023-08-11T18:08:43Z

Wtv-411:

{{WTVPNav}}

URLs for wtv-favorite WTVP service.

{| class="wikitable"
! URL || Description || Methods Supported || wtv-token Present? || Notes
|-
| wtv-favorite:/list-folders || Sent in the <code>wtv-favorites-folders-url</code> header in the [[WTVP/Processes/Headwaiter/Final Responses|final headwaiter response]]. Simple GET service that returns a sequence of NUL-terminated strings for the names of each favorite folder in the current user's account || GET || No ||
|-
| wtv-favorite:/add || [[WTVP/Processes/Favorites#Adding favorites|Favorite add service]]. POST service that adds a website or service page as a favorite to a specified favorite folder on the current user's account. It also submits a thumbnail for the favorite encoded in a proprietary "wtv-bitmap" format || POST || No ||
|-
| wtv-favorite:/serve-folders || Favorites index. Lists all favorite folders a subscriber/user has || GET || ? ||
|-
| wtv-favorite:/serve-browser?favorite-folder-name=xxxxx || Shows favorites in a specified folder ("favorite-folder-name") || GET || ? ||
|-
| wtv-favorite:/serve-add-folder-page || "Add a folder" page || GET || Yes ||
|-
| wtv-favorite:/commit-add-folder?new-folder-name=xxxxx || Adds a favorite folder. Need more documentation on this || GET || Yes ||
|-
| wtv-favorite:/serve-samples-page || Page that allow the subscriber/user to add predefined "sample" folders. Need more documentation on this || GET || Yes ||
|-
| wtv-favorite:/serve-rename-folders || Page that allows the subscriber/user to rename a favorite folder. Need more documentation on this || GET || Yes ||
|-
| wtv-favorite:/commit-rename-folders || Renames favorite folders. Need more documentation on this || GET || Yes ||
|-
| wtv-favorite:/serve-discard-folders || Page that allow the subscriber/user to remove any favorite folder they currently have. Need more documentation on this || GET || Yes ||
|-
| wtv-favorite:/commit-discard-folders || Removes favorite folders. Need more documentation on this || GET || Yes ||
|-
| wtv-favorite:/serve-organize-favorites?favorite-folder-name=xxxxx || Shows options page for managing favorites within a folder || GET || ? ||
|-
| wtv-favorite:/serve-discard-favorites?favorite-folder-name=xxxxx || Allows the subscriber/user to remove favorites within a folder || GET || Yes ||
|-
| wtv-favorite:/serve-arrange-favorites?favorite-folder-name=xxxxx || Shows page that allows enabling/disabling of thumbnails when previewing favorites. Need more documentation on this || GET || Yes ||
|-
| wtv-favorite:/serve-move-favorites?favorite-folder-name=xxxxx || Shows page that allows subscriber/user to move favorites between folders. Need more documentation on this || GET || Yes ||
|-
| wtv-favorite:/serve-shortcuts-favorites?favorite-folder-name=xxxxx || Shows page that allows subscriber/user to assign shortcut keys to favorites. Need more documentation on this || GET || Yes ||
|-
| wtv-favorite:/serve-rename-favorites?favorite-folder-name=xxxxx || Shows page that allows subscriber/user to rename favorites. Need more documentation on this || GET || Yes ||
|-
| wtv-favorite:/MyLinksMain?template=MyLinksMain.tmpl || Presents options to modify link sidebar on info Centers. Need more documentation on this || GET || No(?) ||
|}

WTVP/Services/wtv-favorite/URLs

2023-08-11T18:07:46Z

Wtv-411: Add wtv-favorite:/list-folders and wtv-favorite:/add

{{WTVPNav}}

URLs for wtv-favorite WTVP service.

{| class="wikitable"
! URL || Description || Methods Supported || wtv-token Present? || Notes
|-
| wtv-favorite:/list-folders || Sent in the <code>wtv-favorites-folders-url</code> header in the [[WTVP/Processes/Headwaiter/Final Responses|final headwaiter response]]. Simple GET service that returns a sequence of NUL-terminated strings for the names of each favorite folder in the current user's account || GET || No ||
|-
| wtv-favorite:/add || [[WTVP/Processes/Favorites#Adding favorites|Favorite add service]]. POST service that adds a website or service page as a favorite to a specified favorite folder. It also submits a thumbnail for the favorite encoded in a proprietary "wtv-bitmap" format || POST || No ||
|-
| wtv-favorite:/serve-folders || Favorites index. Lists all favorite folders a subscriber/user has || GET || ? ||
|-
| wtv-favorite:/serve-browser?favorite-folder-name=xxxxx || Shows favorites in a specified folder ("favorite-folder-name") || GET || ? ||
|-
| wtv-favorite:/serve-add-folder-page || "Add a folder" page || GET || Yes ||
|-
| wtv-favorite:/commit-add-folder?new-folder-name=xxxxx || Adds a favorite folder. Need more documentation on this || GET || Yes ||
|-
| wtv-favorite:/serve-samples-page || Page that allow the subscriber/user to add predefined "sample" folders. Need more documentation on this || GET || Yes ||
|-
| wtv-favorite:/serve-rename-folders || Page that allows the subscriber/user to rename a favorite folder. Need more documentation on this || GET || Yes ||
|-
| wtv-favorite:/commit-rename-folders || Renames favorite folders. Need more documentation on this || GET || Yes ||
|-
| wtv-favorite:/serve-discard-folders || Page that allow the subscriber/user to remove any favorite folder they currently have. Need more documentation on this || GET || Yes ||
|-
| wtv-favorite:/commit-discard-folders || Removes favorite folders. Need more documentation on this || GET || Yes ||
|-
| wtv-favorite:/serve-organize-favorites?favorite-folder-name=xxxxx || Shows options page for managing favorites within a folder || GET || ? ||
|-
| wtv-favorite:/serve-discard-favorites?favorite-folder-name=xxxxx || Allows the subscriber/user to remove favorites within a folder || GET || Yes ||
|-
| wtv-favorite:/serve-arrange-favorites?favorite-folder-name=xxxxx || Shows page that allows enabling/disabling of thumbnails when previewing favorites. Need more documentation on this || GET || Yes ||
|-
| wtv-favorite:/serve-move-favorites?favorite-folder-name=xxxxx || Shows page that allows subscriber/user to move favorites between folders. Need more documentation on this || GET || Yes ||
|-
| wtv-favorite:/serve-shortcuts-favorites?favorite-folder-name=xxxxx || Shows page that allows subscriber/user to assign shortcut keys to favorites. Need more documentation on this || GET || Yes ||
|-
| wtv-favorite:/serve-rename-favorites?favorite-folder-name=xxxxx || Shows page that allows subscriber/user to rename favorites. Need more documentation on this || GET || Yes ||
|-
| wtv-favorite:/MyLinksMain?template=MyLinksMain.tmpl || Presents options to modify link sidebar on info Centers. Need more documentation on this || GET || No(?) ||
|}

WTVP/Processes/Miscellaneous

2023-08-11T03:36:38Z

Wtv-411: Add request for splash-sync

{{WTVPNav}}

Documentation for miscellaneous WTVP services utilized by WebTV/MSN TV.

== Address list ==

Simple WTVP <code>GET</code> service hosted on a service URL defined in the [[WTVP/Processes/Headwaiter/Final Responses|final headwaiter response]] with the <code>wtv-addresses-url</code> header. This service is usually hosted on a <code>wtv-mail</code> server, and the original service URL used to host the service was <code>wtv-mail:/addresslist</code>. This service returns a list of contacts in a user's address book, listing both the nickname and e-mail address for each contact. This service is called after the client receives the final headwaiter response during login, or when a user pulls up the Send panel from the Options bar to let them choose which contacts to send a page to through the WebTV/MSN TV Mail service.

The response has a Content-Type of <code>x-wtv-addresses</code>, and the body consists of one or more NUL-terminated string sequences that follow this format: <code>[Contact nickname][0x00][Contact e-mail address][0x00]</code>

<pre>
GET wtv-mail:/addresslist\r\n
wtv-system-cpuspeed: 166164662\r\n
wtv-system-sysconfig: 3116068\r\n
wtv-disk-size: 8006\r\n
wtv-incarnation: 4\r\n
\r\n
</pre>

<pre>
200 OK\n
Connection: Keep-Alive\n
wtv-encrypted: true\n
Content-Type: x-wtv-addresses\n
Content-length: {length of body}\n
\n
John Doe[0x00]johndoe@webtv.net[0x00]Jane Doe[0x00]janedoe@webtv.net[0x00]Joe Britt[0x00]joeb@webtv.net[0x00]
</pre>

== Mail sync service ==

Later in the WebTV/MSN TV service's life (by 2.9 at the latest), some pages started embedding a 1x1 GIF for the sole purpose of updating the message light on the current user's box to notify them of new mail sooner, if any. On the login splash screen, it embeds an image on <code>wtv-mail:/splash-sync</code> to do this. This is another simple WTVP <code>GET</code> service that returns a 43 byte GIF with minimal headers, including the <code>wtv-mail-count</code> header to tell the box how many unread messages the current user has, and an <code>Expires</code> header. Unlike most image files retrieved from the WTVP servers, the one sent by splash-sync is encrypted. Why it's encrypted is currently unclear.

<pre>
GET wtv-mail:/splash-sync-wtv-token-2442596988-F4BAA3E63FAE9A29B47246A4024BF8A1\r\n
Referer: wtv-head-waiter:/login-stage-two-wtv-token-3978878462-9763BA920CF00DB580F18DB8A4069C74?new_registration=1\r\n
wtv-system-cpuspeed: 166164662\r\n
wtv-system-sysconfig: 3116068\r\n
wtv-disk-size: 8006\r\n
wtv-incarnation: 14\r\n
\r\n
</pre>

<pre>
200 OK\n
Connection: Keep-Alive\n
wtv-encrypted: true\n
wtv-mail-count: {number of unread emails in user's inbox}\n
Expires: 60\n
Content-type: image/gif\n
Content-length: 43\n
\n
{GIF image data}
</pre>

<pre>
47 49 46 38 39 61 02 00 02 00 80 00 00 2B 2B 2B GIF89a....€..+++
00 00 00 21 F9 04 01 00 00 00 00 2C 00 00 00 00 ...!ù......,....
02 00 02 00 00 02 02 84 51 00 ........Q.
</pre>

----

It's believed that the service <code>wtv-mail:/update-light</code> performs a similar function to splash-sync. What's believed to be its response also sends a 43 byte GIF image, but the only captures we've seen of it are ones without any mail-related headers. Like splash-sync, the GIF is encrypted.

<pre>
200 OK\n
Connection: Keep-Alive\n
wtv-encrypted: true\n
Content-type: image/gif\n
Content-length: 43\n
\n
{GIF image data}
</pre>

WTVP/Processes/Favorites

2023-08-11T01:49:42Z

Wtv-411: /* Adding favorites */ Start writing documentation on favorite add service

{{WTVPNav}}

== Folder list ==
When a WebTV/MSN TV client has to retrieve the list of favorite folders for the current user, it will make a WTVP <code>GET</code> request to the service URL defined in the <code>wtv-favorites-folders-url</code> header from the final headwaiter response. The service the URL points to is usually hosted on <code>wtv-favorite</code>, and the service URL used by the original service was <code>wtv-favorite:/list-folders</code>.

The response for the folder list service has a Content-Type of <code>text/html</code>, but the body data is a NUL-terminated sequence of strings representing the names of the favorite folders on the current user's account.

<pre>
200 OK\n
Connection: Keep-Alive\n
wtv-encrypted: true\n
wtv-lzpf: 0\n
Content-length: {length of body}\n
Content-type: text/html\n
\n
Personal[0x00]Recommended[0x00]
</pre>

== Adding favorites ==

WebTV and MSN TV have a panel for adding a site as a favorite to a designated favorite folder, which can be opened by selecting the "Save" button from the Options panel. When a user adds a site as a favorite, the client will make a <code>POST</code> request to the service URL <code>wtv-favorite:/add</code>, which sends a query string of the information for the favorite and which folder to put it in, along with an image type for the thumbnail. The thumbnail data is sent in the body.

<pre>
POST wtv-favorite:/add?favorite-category=Favorite+Folder+Name&favorite-title=Website+Title&favorite-thumbnail-type=image/wtv-bitmap&favorite-url=wtv-home%3A%2Fhome\r\n
wtv-system-cpuspeed: 166164662\r\n
wtv-system-sysconfig: 3116068\r\n
wtv-disk-size: 8006\r\n
wtv-incarnation: 32\r\n
Content-type: application/x-www-form-urlencoded\r\n
Content-length: {length of thumbnail data}\r\n
\r\n
</pre>

'''TODO: Write up how favorite service works server-side'''

=== Parameters ===

{| class="wikitable"
|-
! Parameter
! Description
|-
| favorite-category
| The name of the favorite folder (category) to add the favorite to
|-
| favorite-name
| The name for the favorite (usually the page title)
|-
| favorite-thumbnail-type
| The file type for the favorite thumbnail to upload for the favorite. Currently, the only known value sent is <code>image/wtv-bitmap</code>
|-
| favorite-url
| URL for the favorite to point to. This can be a service URL or a normal website URL
|}

Template:WTVPNav

2023-08-11T00:36:41Z

Wtv-411: Add Favorites link

{| class="wikitable" style="width: 200px; float: right; margin: 0 0 1em 1em; text-align: center"
! style="font-size: 20px" | WTVP
|-
| [[WTVP|Overview]] • [[List of WTVP Services|List of WTVP Services]] • [[WTVP-specific Content Types|WTVP-specific Content-Types]] • [[WTVP Status Codes|Status Codes]]
|-
! style="font-size: 12px" | Concepts
|-
| [[Tokens|Tokens]] • [[WTVP/Tickets|Tickets]] • [[Capability Flags|Capability Flags]]
|-
! style="font-size: 12px" | Headers
|-
| [[WTVP/Headers/List|Header List]] • [[WTVP/Headers/Data Types|Data Types]] • [[Common WTVP Request Headers|Common Request Headers]]
|-
! style="font-size: 12px" | Processes
|-
| [[WTVP/Processes/First-Time Registration|First-Time Registration]] • [[WTVP/Processes/Headwaiter|Headwaiter (Login)]] • [[Services/Technical/Messenger#WTVP|Messenger Services]] • [[WTVP/Processes/Favorites|Favorites]] • [[WTVP/Processes/MessageWatch|Checking for new mail]] • [[WTVP/Processes/Retrieving settings|Retrieving settings]] • [[WTVP/Processes/Obtaining a new wtv-ticket|Obtaining new wtv-tickets]] • [[Smart Card]] • [[WTVP/Processes/Miscellaneous|Miscellaneous]]
|-
! style="font-size: 12px" | URLs for WTVP Services
|-
| [[WTVP/Services/wtv-1800/URLs|wtv-1800]] • [[WTVP/Services/wtv-aroundtown/URLs|wtv-aroundtown]] • [[WTVP/Services/wtv-author/URLs|wtv-author]] • [[WTVP/Services/wtv-center/URLs|wtv-center]] • [[WTVP/Services/wtv-chat/URLs|wtv-chat]] • [[WTVP/Services/wtv-content/URLs|wtv-content]] • [[WTVP/Services/wtv-cookie/URLs|wtv-cookie]] • [[WTVP/Services/wtv-customscript/URLs|wtv-customscript]] • [[WTVP/Services/wtv-disk/URLs|wtv-disk]] • [[WTVP/Services/wtv-epguide/URLs|wtv-epguide]] • [[WTVP/Services/wtv-favorite/URLs|wtv-favorite]] • [[WTVP/Services/wtv-flashrom/URLs|wtv-flashrom]] • [[WTVP/Services/wtv-guide/URLs|wtv-guide]] • [[WTVP/Services/wtv-head-waiter/URLs|wtv-head-waiter]] • [[WTVP/Services/wtv-home/URLs|wtv-home]] • [[WTVP/Services/wtv-intro/URLs|wtv-intro]] • [[WTVP/Services/wtv-log/URLs|wtv-log]] • [[WTVP/Services/wtv-mail/URLs|wtv-mail]] • [[WTVP/Services/wtv-news/URLs|wtv-news]] • [[WTVP/Services/wtv-notices/URLs|wtv-notices]] • [[WTVP/Services/wtv-partner/URLs|wtv-partner]] • [[WTVP/Services/wtv-passport/URLs|wtv-passport]] • [[WTVP/Services/wtv-register/URLs|wtv-register]] • [[WTVP/Services/wtv-setup/URLs|wtv-setup]] • [[WTVP/Services/wtv-smartcard/URLs|wtv-smartcard]] • [[WTVP/Services/wtv-spot/URLs|wtv-spot]] • [[WTVP/Services/wtv-star/URLs|wtv-star]] • [[WTVP/Services/wtv-tricks/URLs|wtv-tricks]] • [[WTVP/Services/wtv-tutorial/URLs|wtv-tutorial]]
|}

WTVP/Processes/Favorites

2023-08-11T00:31:17Z

Wtv-411: Add initial WTVP favorites page

Template:WTVPNav

2023-08-10T23:49:35Z

Wtv-411: Add miscellaneous link

{| class="wikitable" style="width: 200px; float: right; margin: 0 0 1em 1em; text-align: center"
! style="font-size: 20px" | WTVP
|-
| [[WTVP|Overview]] • [[List of WTVP Services|List of WTVP Services]] • [[WTVP-specific Content Types|WTVP-specific Content-Types]] • [[WTVP Status Codes|Status Codes]]
|-
! style="font-size: 12px" | Concepts
|-
| [[Tokens|Tokens]] • [[WTVP/Tickets|Tickets]] • [[Capability Flags|Capability Flags]]
|-
! style="font-size: 12px" | Headers
|-
| [[WTVP/Headers/List|Header List]] • [[WTVP/Headers/Data Types|Data Types]] • [[Common WTVP Request Headers|Common Request Headers]]
|-
! style="font-size: 12px" | Processes
|-
| [[WTVP/Processes/First-Time Registration|First-Time Registration]] • [[WTVP/Processes/Headwaiter|Headwaiter (Login)]] • [[Services/Technical/Messenger#WTVP|Messenger Services]] • [[WTVP/Processes/MessageWatch|Checking for new mail]] • [[WTVP/Processes/Retrieving settings|Retrieving settings]] • [[WTVP/Processes/Obtaining a new wtv-ticket|Obtaining new wtv-tickets]] • [[Smart Card]] • [[WTVP/Processes/Miscellaneous|Miscellaneous]]
|-
! style="font-size: 12px" | URLs for WTVP Services
|-
| [[WTVP/Services/wtv-1800/URLs|wtv-1800]] • [[WTVP/Services/wtv-aroundtown/URLs|wtv-aroundtown]] • [[WTVP/Services/wtv-author/URLs|wtv-author]] • [[WTVP/Services/wtv-center/URLs|wtv-center]] • [[WTVP/Services/wtv-chat/URLs|wtv-chat]] • [[WTVP/Services/wtv-content/URLs|wtv-content]] • [[WTVP/Services/wtv-cookie/URLs|wtv-cookie]] • [[WTVP/Services/wtv-customscript/URLs|wtv-customscript]] • [[WTVP/Services/wtv-disk/URLs|wtv-disk]] • [[WTVP/Services/wtv-epguide/URLs|wtv-epguide]] • [[WTVP/Services/wtv-favorite/URLs|wtv-favorite]] • [[WTVP/Services/wtv-flashrom/URLs|wtv-flashrom]] • [[WTVP/Services/wtv-guide/URLs|wtv-guide]] • [[WTVP/Services/wtv-head-waiter/URLs|wtv-head-waiter]] • [[WTVP/Services/wtv-home/URLs|wtv-home]] • [[WTVP/Services/wtv-intro/URLs|wtv-intro]] • [[WTVP/Services/wtv-log/URLs|wtv-log]] • [[WTVP/Services/wtv-mail/URLs|wtv-mail]] • [[WTVP/Services/wtv-news/URLs|wtv-news]] • [[WTVP/Services/wtv-notices/URLs|wtv-notices]] • [[WTVP/Services/wtv-partner/URLs|wtv-partner]] • [[WTVP/Services/wtv-passport/URLs|wtv-passport]] • [[WTVP/Services/wtv-register/URLs|wtv-register]] • [[WTVP/Services/wtv-setup/URLs|wtv-setup]] • [[WTVP/Services/wtv-smartcard/URLs|wtv-smartcard]] • [[WTVP/Services/wtv-spot/URLs|wtv-spot]] • [[WTVP/Services/wtv-star/URLs|wtv-star]] • [[WTVP/Services/wtv-tricks/URLs|wtv-tricks]] • [[WTVP/Services/wtv-tutorial/URLs|wtv-tutorial]]
|}

WTVP/Processes/Miscellaneous

2023-08-10T23:48:28Z

Wtv-411: Add WTVPNav

{{WTVPNav}}

Documentation for miscellaneous WTVP services utilized by WebTV/MSN TV.

== Address list ==

Simple WTVP <code>GET</code> service hosted on a service URL defined in the [[WTVP/Processes/Headwaiter/Final Responses|final headwaiter response]] with the <code>wtv-addresses-url</code> header. This service is usually hosted on a <code>wtv-mail</code> server, and the original service URL used to host the service was <code>wtv-mail:/addresslist</code>. This service returns a list of contacts in a user's address book, listing both the nickname and e-mail address for each contact. This service is called after the client receives the final headwaiter response during login, or when a user pulls up the Send panel from the Options bar to let them choose which contacts to send a page to through the WebTV/MSN TV Mail service.

The response has a Content-Type of <code>x-wtv-addresses</code>, and the body consists of one or more NUL-terminated string sequences that follow this format: <code>[Contact nickname][0x00][Contact e-mail address][0x00]</code>

<pre>
GET wtv-mail:/addresslist\r\n
wtv-system-cpuspeed: 166164662\r\n
wtv-system-sysconfig: 3116068\r\n
wtv-disk-size: 8006\r\n
wtv-incarnation: 4\r\n
\r\n
</pre>

<pre>
200 OK\n
Connection: Keep-Alive\n
wtv-encrypted: true\n
Content-Type: x-wtv-addresses\n
Content-length: {length of body}\n
\n
John Doe[0x00]johndoe@webtv.net[0x00]Jane Doe[0x00]janedoe@webtv.net[0x00]Joe Britt[0x00]joeb@webtv.net[0x00]
</pre>

== Mail sync service ==

Later in the WebTV/MSN TV service's life (by 2.9 at the latest), some pages started embedding a 1x1 GIF for the sole purpose of updating the message light on the current user's box to notify them of new mail sooner, if any. On the login splash screen, it embeds an image on <code>wtv-mail:/splash-sync</code> to do this. This is another simple WTVP <code>GET</code> service that returns a 43 byte GIF with minimal headers, including the <code>wtv-mail-count</code> header to tell the box how many unread messages the current user has, and an <code>Expires</code> header. Unlike most image files retrieved from the WTVP servers, the one sent by splash-sync is encrypted. Why it's encrypted is currently unclear.

<pre>
200 OK\n
Connection: Keep-Alive\n
wtv-encrypted: true\n
wtv-mail-count: {number of unread emails in user's inbox}\n
Expires: 60\n
Content-type: image/gif\n
Content-length: 43\n
\n
{GIF image data}
</pre>

<pre>
47 49 46 38 39 61 02 00 02 00 80 00 00 2B 2B 2B GIF89a....€..+++
00 00 00 21 F9 04 01 00 00 00 00 2C 00 00 00 00 ...!ù......,....
02 00 02 00 00 02 02 84 51 00 ........Q.
</pre>

It's believed that the service <code>wtv-mail:/update-light</code> performs a similar function to splash-sync. What's believed to be its response also sends a 43 byte GIF image, but the only captures we've seen of it are ones without any mail-related headers. Like splash-sync, the GIF is encrypted.

<pre>
200 OK\n
Connection: Keep-Alive\n
wtv-encrypted: true\n
Content-type: image/gif\n
Content-length: 43\n
\n
{GIF image data}
</pre>

WTVP/Processes/Miscellaneous

2023-08-10T23:48:03Z

Wtv-411: Add miscellaneous page for WTVP

Documentation for miscellaneous WTVP services utilized by WebTV/MSN TV.

== Address list ==

Simple WTVP <code>GET</code> service hosted on a service URL defined in the [[WTVP/Processes/Headwaiter/Final Responses|final headwaiter response]] with the <code>wtv-addresses-url</code> header. This service is usually hosted on a <code>wtv-mail</code> server, and the original service URL used to host the service was <code>wtv-mail:/addresslist</code>. This service returns a list of contacts in a user's address book, listing both the nickname and e-mail address for each contact. This service is called after the client receives the final headwaiter response during login, or when a user pulls up the Send panel from the Options bar to let them choose which contacts to send a page to through the WebTV/MSN TV Mail service.

The response has a Content-Type of <code>x-wtv-addresses</code>, and the body consists of one or more NUL-terminated string sequences that follow this format: <code>[Contact nickname][0x00][Contact e-mail address][0x00]</code>

<pre>
GET wtv-mail:/addresslist\r\n
wtv-system-cpuspeed: 166164662\r\n
wtv-system-sysconfig: 3116068\r\n
wtv-disk-size: 8006\r\n
wtv-incarnation: 4\r\n
\r\n
</pre>

<pre>
200 OK\n
Connection: Keep-Alive\n
wtv-encrypted: true\n
Content-Type: x-wtv-addresses\n
Content-length: {length of body}\n
\n
John Doe[0x00]johndoe@webtv.net[0x00]Jane Doe[0x00]janedoe@webtv.net[0x00]Joe Britt[0x00]joeb@webtv.net[0x00]
</pre>

== Mail sync service ==

Later in the WebTV/MSN TV service's life (by 2.9 at the latest), some pages started embedding a 1x1 GIF for the sole purpose of updating the message light on the current user's box to notify them of new mail sooner, if any. On the login splash screen, it embeds an image on <code>wtv-mail:/splash-sync</code> to do this. This is another simple WTVP <code>GET</code> service that returns a 43 byte GIF with minimal headers, including the <code>wtv-mail-count</code> header to tell the box how many unread messages the current user has, and an <code>Expires</code> header. Unlike most image files retrieved from the WTVP servers, the one sent by splash-sync is encrypted. Why it's encrypted is currently unclear.

<pre>
200 OK\n
Connection: Keep-Alive\n
wtv-encrypted: true\n
wtv-mail-count: {number of unread emails in user's inbox}\n
Expires: 60\n
Content-type: image/gif\n
Content-length: 43\n
\n
{GIF image data}
</pre>

<pre>
47 49 46 38 39 61 02 00 02 00 80 00 00 2B 2B 2B GIF89a....€..+++
00 00 00 21 F9 04 01 00 00 00 00 2C 00 00 00 00 ...!ù......,....
02 00 02 00 00 02 02 84 51 00 ........Q.
</pre>

It's believed that the service <code>wtv-mail:/update-light</code> performs a similar function to splash-sync. What's believed to be its response also sends a 43 byte GIF image, but the only captures we've seen of it are ones without any mail-related headers. Like splash-sync, the GIF is encrypted.

<pre>
200 OK\n
Connection: Keep-Alive\n
wtv-encrypted: true\n
Content-type: image/gif\n
Content-length: 43\n
\n
{GIF image data}
</pre>

Main Page

2023-08-10T00:50:49Z

Wtv-411: Add Replacing WebTV (MSN TV) Hard Drives link

Welcome to the WebTV/MSN TV Wiki! WebTV, later known as MSN TV, is an internet access device consisting of a set top box that utilized dial-up access (and later on, broadband), using a keyboard and remote for user input. It was also a specialized service complementing said devices that they would connect to for access to the general internet and WebTV/MSN TV's own online services. The product and service launched in 1996 as WebTV, and a year later the company behind this technology, WebTV Networks, was acquired by Microsoft. WebTV later became MSN TV circa 2001, and the entire service would eventually be discontinued on September 30, 2013. This wiki is '''NOT''' about the "WebTV for Windows" application bundled with Windows 98, which is essentially a souped up TV tuner, nor is this wiki about any video streaming services with "Web TV" in the name.

What we are accomplishing with this wiki is to seek out, collect, and document as much information as we can gather on the WebTV/MSN TV internet product's hardware, services, protocols, and other subjects concerning it. Much to the surprise of many, WebTV/MSN TV did indeed already have people focused on learning about the product and how it worked, primarily in its hacking scene. Up until 2021, however, only surface level information about the product and service (especially in regards to its many vulnerabilities), or basic writeups about the technical portions of WebTV/MSN TV were available for public consumption, with most information about WebTV/MSN TV either remaining undocumented, poorly preserved, or in regards to some technical information, circulated privately by select people, never to see the light of day. We're here to make up for that and make all information on WebTV/MSN TV centralized, public, and easily accessible, using information that we have been able to obtain from scene sites, from our own research, and in private from those who know a bit about the product/service. '''We are here to rip open the guts of the entire WebTV/MSN TV service and technology and make it known for all!'''

This wiki was originally run by an anonymous person, wtv-411, from early 2021 to September 2022. Ownership of the wiki has since been transferred to JarHead, and future updates to the wiki will be published here.

For now, this wiki will mostly focus on the first generation of WebTV/MSN TV (pre-MSN TV 2) technologies and services, and try to make sense of how they worked. We hope to extend on other information we have though, especially with information concerning the MSN TV 2 seeing as information on that variant of the product and corresponding service specifically is extremely endangered, moreso than the first generation of WebTV/MSN TV products to our knowledge.

----

Do you or someone you know have any crucial WebTV-related information we're seeking to preserve? Check out our [[Wanted]] page.

Interested in backing up your WebTV/UltimateTV/DishPlayer hard drives for any reason? Check out the guide we wrote on doing that: [[Backing Up WebTV (MSN TV) Hard Drives]].

Need to replace the hard drive in your WebTV/MSN TV boxes? Check out [[Replacing WebTV (MSN TV) Hard Drives]]

Want to install Linux on an MSN TV 2 box? Check out [[Installing Linux on the MSN TV 2 (RM4100)]].

Join the [https://discord.gg/qke279EUa8 WebTV/MSN TV Discord server] to chat about anything WebTV/MSN TV with like minded people.

----
'''UPDATE - 3/16/2023:''' Hello people. This is wtv-411. Bet you weren't expecting me to make another appearance after saying that I've moved on, huh? To tell the truth, I was mostly just burnt out from being involved with the WebTV community, as well as just actively running and writing for the wiki at the time, although my activity since then has been more discrete and I mostly help out with things in the background when I can. While things have gone quiet since JarHead has taken the reigns, I have been blessed with the privilege of being a contributor yet again and I have been putting in what little free time and motivation I have with this into polishing and updating the information on this wiki. I have added some more info on the hardware used by WebTV, as well as adding some minor updates to the MSN TV 2 page and some other pages, but I don't think I'll be doing anything more major than that considering how much effort is needed to keep this wiki running. Oh, and also the site doesn't properly show up in Google search results and only Google's for some reason, possibly because of the haphazard domain migration from the old domain and also the weird dual HTTP-HTTPS setup this site has right now. Wonderful. I am looking into transferring the old webtvwiki.net domain to the holder of the wiki's current domain before the end of the year, which might not change things by much but it may help in keeping things consistent.

On the flip side, I just got around to publishing the little info I have gathered and discovered on the MSN TV 2's service, as well as some info on the firmware, on a separate GitHub wiki since I feel that it is not only easier to manage, but will also allow more people to easily find it compared to a small obscure wiki that you can't even search for anymore. You can view it [https://github.com/wtv-411/msntv2-docs/wiki here]. It may not get consistent updates due to real life obligations as well as the nature of the thing the wiki is focused on, but I am definitely looking forward to working on that more than this.

'''IMPORTANT UPDATE - 9/11/2022:''' Hey everybody! I'm JarHead, the new operator of this wiki from now on. Things have been a bit hectic the past few hours, so things might not be exactly correct just yet. Outside of domains just changing, I'll also be publishing my own knowledge about WebTV that I've gained over the past 3 years I've been working with WebTV, so I hope you can learn as much as I have.

For older updates: [[Archived Updates]]

----

* [[UltimateTV]]
* [[Microsoft TV]] '''NEW'''
* [[SNAP2 Corporation]]
* [[MAME]]
* [[Doom for WebTV]]
* [[Network]]
** [[Services]]
** [[Protocols]]
** [[Tokens]]
** [[Network Infrastructure|Infrastructure]]
** "[[The Great(er) Scroll of Dialing Wisdom|Greater Scroll of Dialing Wisdom]]"
* [[Data Formats]]
* [[Hardware]]
** [[Hardware Models|Models]]
** [[WebTV Memory Map]]
** [[Power-Off Codes]]
* [[ROM]]
* [[WebTV Viewer]]
* [[WebTV for Dreamcast]]
* [[Client Commands]]
* [[WebTV Upgrade History]]

* [[MSN TV 2]]

* [[Glossary]]
* [[Further Links]]
* [[Wanted]]
* [[Community]]
* [[Thanks]]

Template:WTVPNav

2023-08-05T20:53:53Z

Wtv-411:

{| class="wikitable" style="width: 200px; float: right; margin: 0 0 1em 1em; text-align: center"
! style="font-size: 20px" | WTVP
|-
| [[WTVP|Overview]] • [[List of WTVP Services|List of WTVP Services]] • [[WTVP-specific Content Types|WTVP-specific Content-Types]] • [[WTVP Status Codes|Status Codes]]
|-
! style="font-size: 12px" | Concepts
|-
| [[Tokens|Tokens]] • [[WTVP/Tickets|Tickets]] • [[Capability Flags|Capability Flags]]
|-
! style="font-size: 12px" | Headers
|-
| [[WTVP/Headers/List|Header List]] • [[WTVP/Headers/Data Types|Data Types]] • [[Common WTVP Request Headers|Common Request Headers]]
|-
! style="font-size: 12px" | Processes
|-
| [[WTVP/Processes/First-Time Registration|First-Time Registration]] • [[WTVP/Processes/Headwaiter|Headwaiter (Login)]] • [[Services/Technical/Messenger#WTVP|Messenger Services]] • [[WTVP/Processes/MessageWatch|Checking for new mail]] • [[WTVP/Processes/Retrieving settings|Retrieving settings]] • [[WTVP/Processes/Obtaining a new wtv-ticket|Obtaining new wtv-tickets]] • [[Smart Card]]
|-
! style="font-size: 12px" | URLs for WTVP Services
|-
| [[WTVP/Services/wtv-1800/URLs|wtv-1800]] • [[WTVP/Services/wtv-aroundtown/URLs|wtv-aroundtown]] • [[WTVP/Services/wtv-author/URLs|wtv-author]] • [[WTVP/Services/wtv-center/URLs|wtv-center]] • [[WTVP/Services/wtv-chat/URLs|wtv-chat]] • [[WTVP/Services/wtv-content/URLs|wtv-content]] • [[WTVP/Services/wtv-cookie/URLs|wtv-cookie]] • [[WTVP/Services/wtv-customscript/URLs|wtv-customscript]] • [[WTVP/Services/wtv-disk/URLs|wtv-disk]] • [[WTVP/Services/wtv-epguide/URLs|wtv-epguide]] • [[WTVP/Services/wtv-favorite/URLs|wtv-favorite]] • [[WTVP/Services/wtv-flashrom/URLs|wtv-flashrom]] • [[WTVP/Services/wtv-guide/URLs|wtv-guide]] • [[WTVP/Services/wtv-head-waiter/URLs|wtv-head-waiter]] • [[WTVP/Services/wtv-home/URLs|wtv-home]] • [[WTVP/Services/wtv-intro/URLs|wtv-intro]] • [[WTVP/Services/wtv-log/URLs|wtv-log]] • [[WTVP/Services/wtv-mail/URLs|wtv-mail]] • [[WTVP/Services/wtv-news/URLs|wtv-news]] • [[WTVP/Services/wtv-notices/URLs|wtv-notices]] • [[WTVP/Services/wtv-partner/URLs|wtv-partner]] • [[WTVP/Services/wtv-passport/URLs|wtv-passport]] • [[WTVP/Services/wtv-register/URLs|wtv-register]] • [[WTVP/Services/wtv-setup/URLs|wtv-setup]] • [[WTVP/Services/wtv-smartcard/URLs|wtv-smartcard]] • [[WTVP/Services/wtv-spot/URLs|wtv-spot]] • [[WTVP/Services/wtv-star/URLs|wtv-star]] • [[WTVP/Services/wtv-tricks/URLs|wtv-tricks]] • [[WTVP/Services/wtv-tutorial/URLs|wtv-tutorial]]
|}

Smart Card

2023-08-05T20:53:30Z

Wtv-411: Completely overhaul smart card page - write more proper documentation on version 2 format and WTVP side, and add client command for writing to smart cards

{{WTVPNav}}

Smart cards were used on the WebTV and first-generation MSN TV service to take the user to a site, set up ISP options, etc. They were rarely utilized, and were removed on the MSN TV 2.

WebTV/MSN TV boxes support smart cards that are compliant with the [https://en.wikipedia.org/wiki/ISO/IEC_7816 ISO 7816 standard]. Smart cards can hold up to 122 bytes of data.

== Inserting a smart card ==
When a smart card is inserted into the WebTV/MSN TV receiver, it will show a message on the screen with the smart card name and a progress bar. In the background, the box will contact the URL from the <code>wtv-smartcard-inserted-url</code> header sent from headwaiter, which is usually <code>wtv-smartcard:/insert</code>. The box will <code>POST</code> the raw data read from the card to the URL. While official clients can supposedly send the smart card data raw, it has only been documented to send the data as a Base64 encoded string that has every 4-byte block of data byte swapped:

<pre>
POST wtv-smartcard:/insert\r\n
User-Agent: Mozilla/4.0 WebTV/2.6 (compatible; MSIE 4.0)\r\n
wtv-show-time-record: 4 <wtv-home:/home?>\r\n
wtv-request-type: primary\r\n
wtv-incarnation: 14\r\n
Content-type: application/octet-stream\r\n
Content-length: 36\r\n
\r\n
/fkMTtAd552bhZFIlVHbHcEI5kTa5kTO==QO
</pre>

<code>/fkMTtAd552bhZFIlVHbHcEI5kTa5kTO==QO -> Mkf/dAtTb255IFZhbHVlIEcHaTk5OTk5OQ==</code>

The server will unswap the bytes, decode the data into its raw binary form, and then parse it as smart card data to determine what to do with it. While the specifics of the <code>wtv-smartcard</code> service aren't well known, what is known is that the server will redirect the box to a website specified by the smart card if it is a "Go To" card, and send an error page if the data is invalid.

In some cases, the box will send an error header (e.g: "error=-68") if something goes wrong.

== Format ==

WebTV/MSN TV smart cards use a proprietary format to store data. There are two known versions of the format that WebTV Networks developed: version 1 and version 2. The only smart card known to be produced for WebTV boxes (the Sony smart card bundled with Sony WebTV Plus units) uses the version 2 format, though.

Thanks to internal WebTV pages from a "smart card factory" service containing JavaScript that directly handled writing in both formats, these formats have been able to be reverse engineered to varying degrees of success. This page will only cover the version 2 smart card format for the time being, since that is the format we have the most information on.

=== Version 2 ===
Version 2 smart cards make use of a header and TLVs (type-length-value) to store data. A TLV performs one specific function based on the type specified and stores data in a specific way. Version 2 smart cards can have one TLV at minimum for the main card data that corresponds to the card type in the header. If the card type is not a deregistration card, the smart card can also contain an optional title TLV, which has to precede all other TLVs and contains text that will be displayed as a title in a dialog box when the smart card is inserted into the WebTV/MSN TV box. Multiple TLVs in general can be added if the card type isn't set to deregistration or if it is set as a "multi" card, which can perform several functions at once.

The general format for version 2 smart cards goes like this:

{| class="wikitable"
|-
! Offset
! Length
! Description
|-
| 0x00
| 1 byte
| Version identifier. Always <code>2</code> (0x32)
|-
| 0x01
| 1 byte
| Card type
|-
| 0x02
| 1 byte
| CRC value. This is an optional field and a value of 0xff can be specified to make WebTV/MSN TV ignore the CRC. The actual algorithm used for this CRC is currently unknown
|-
| 0x03
| Variable
| TLV data
|}

TLVs are simple structures that store data under a specified type. While constrained by the 122-byte limit for smart cards, they can theoretically hold up to 256 bytes of data. TLVs follow this format:

{| class="wikitable"
|-
! Field
! Length
! Description
|-
| Type
| 1 byte
| Type code
|-
| Length
| 1 byte
| 8-bit length of value
|-
| Value
| Variable
| Variable length value data
|}

==== Known Card Types ====
* A - '''A'''ffinity. This feature is currently undocumented, but involves an enrollment and program code
* F - '''F'''avorites
* W - Deregistration. Only the deregstration TLV can be present in the smart card data if this type is set
* O - '''O'''penISP (Use your own ISP)
* G - '''G'''o To (a website)
* M - Multi-card. Stores multiple TLVs to run several card functions at one time

==== Known TLVs ====
Below is a list of TLVs known to be used by the version 2 smart card format. TLVs will be listed by their type code.

===== "t" (Title) =====
* Description: Specifies a title to set for the smart card. Optional, but has to precede all other TLVs. This TLV can '''not''' be present in deregistration smart cards
* Value: The title for the smart card

===== "A" (Affinity data) =====
* Description: Required for Affinity smart cards
* Value: A byte for the version number (either <code>1</code> for version 1 Affinity data or <code>2</code> for version 2 Affinity data), followed by the actual data.
** For version 2 Affinity data: The format is the program code, a tab character (0x09), and the enrollment code
** For version 1 Affinity data: Just the enrollment code

===== "G" (Go To data) =====
* Description: Data that defines a website the smart card will make the box access. The wtv-smartcard service would have taken care of redirecting the client to the specified site if it existed. Required for "Go To" smart cards
* Value: A byte for the type of website to be accessed (<code>i</code> - Server-side numeric ID that will be translated by the WebTV/MSN TV service, <code>h</code> - HTTP URL, <code>s</code> - HTTPS URL), followed by a numeric ID if the type is <code>i</code>, or the direct URL for the site without the "http(s)://" prefix otherwise

===== "O" (OpenISP) =====
* Description: Data for setting up a predefined custom ISP to connect to WebTV/MSN TV with. Required for OpenISP smart cards
* Value: The character "1", followed by the ISP data separated with a tab character (0x09)

ISP information structure:
* ISP name - String
* 0x09 separator
* ISP login name - String
* 0x09 separator
* ISP password - String
* 0x09 separator
* Primary modem number - 10-digit phone number
* 0x09 separator
* Backup modem number - 10-digit phone number. Optional

===== "W" (Deregistration) =====
* Description: Data for de-registering a client. If this TLV is used, then the card type '''must''' be set to deregistration as well and no other TLVs may be added
* Value: Binary structure

Deregistration data structure:

{| class="wikitable"
|-
! Offset
! Length
! Description
|-
| 0x00
| 4 bytes
| Contains a specific sequence of bytes (in hex: <code>31 75 fa b0</code>). Purpose for these is unknown
|-
| 0x04
| 4 bytes
| A UNIX timestamp for when the deregistration card expires. On the WebTV smart card factory pages, this is always set to 0xffffffff to set it to not expire
|-
| 0x08
| Variable
| Deregistration code
|}

==== Format Example ====
The following example shows a break down of the data from an official Sony WebTV Plus smart card, which uses the version 2 smart card format and is a "Go to" card. The card would have originally sent to the service a site ID of 999999, which would redirect the user to the Sony-operated site <nowiki>http://www.svalue.com</nowiki> (no longer run by Sony).

{| class="wikitable"
|-
! Field
! Value
|-
| Version
| <code>2</code> (0x32)
|-
| Type
| <code>G</code> (Go to)
|-
| CRC
| 0xFF (Ignore)
|-
| TLV #1 Type
| <code>t</code> (Title)
|-
| TLV #1 Length
| 0x0B
|-
| TLV #1 Value
| "Sony Value "
|-
| TLV #2 Type
| <code>G</code> (Go to)
|-
| TLV #2 Length
| 0x07
|-
| TLV #2 Value
| "i999999" (Server-side numeric ID 999999 - pointed to <nowiki>http://www.svalue.com</nowiki> on the original server)
|}


== Client-Side ==

WebTV and MSN TV boxes have the ability to write to compatible smart cards inserted into their smart card slot. This is done with the client command <code>client:SaveToSmartCard?data={data}</code>, with <code>{data}</code> being the raw smart card data, which can be URL encoded if necessary.

User:Wtv-411/Smart Card

2023-08-05T20:50:22Z

Wtv-411: Final touches and fixes

{{WTVPNav}}

'''WIP'''

----

Smart cards were used on the WebTV and first-generation MSN TV service to take the user to a site, set up ISP options, etc. They were rarely utilized, and were removed on the MSN TV 2.

WebTV/MSN TV boxes support smart cards that are compliant with the [https://en.wikipedia.org/wiki/ISO/IEC_7816 ISO 7816 standard]. Smart cards can hold up to 122 bytes of data.

== Inserting a smart card ==
When a smart card is inserted into the WebTV/MSN TV receiver, it will show a message on the screen with the smart card name and a progress bar. In the background, the box will contact the URL from the <code>wtv-smartcard-inserted-url</code> header sent from headwaiter, which is usually <code>wtv-smartcard:/insert</code>. The box will <code>POST</code> the raw data read from the card to the URL. While official clients can supposedly send the smart card data raw, it has only been documented to send the data as a Base64 encoded string that has every 4-byte block of data byte swapped:

<pre>
POST wtv-smartcard:/insert\r\n
User-Agent: Mozilla/4.0 WebTV/2.6 (compatible; MSIE 4.0)\r\n
wtv-show-time-record: 4 <wtv-home:/home?>\r\n
wtv-request-type: primary\r\n
wtv-incarnation: 14\r\n
Content-type: application/octet-stream\r\n
Content-length: 36\r\n
\r\n
/fkMTtAd552bhZFIlVHbHcEI5kTa5kTO==QO
</pre>

<code>/fkMTtAd552bhZFIlVHbHcEI5kTa5kTO==QO -> Mkf/dAtTb255IFZhbHVlIEcHaTk5OTk5OQ==</code>

The server will unswap the bytes, decode the data into its raw binary form, and then parse it as smart card data to determine what to do with it. While the specifics of the <code>wtv-smartcard</code> service aren't well known, what is known is that the server will redirect the box to a website specified by the smart card if it is a "Go To" card, and send an error page if the data is invalid.

In some cases, the box will send an error header (e.g: "error=-68") if something goes wrong.

== Format ==

WebTV/MSN TV smart cards use a proprietary format to store data. There are two known versions of the format that WebTV Networks developed: version 1 and version 2. The only smart card known to be produced for WebTV boxes (the Sony smart card bundled with Sony WebTV Plus units) uses the version 2 format, though.

Thanks to internal WebTV pages from a "smart card factory" service containing JavaScript that directly handled writing in both formats, these formats have been able to be reverse engineered to varying degrees of success. This page will only cover the version 2 smart card format for the time being, since that is the format we have the most information on.

=== Version 2 ===
Version 2 smart cards make use of a header and TLVs (type-length-value) to store data. A TLV performs one specific function based on the type specified and stores data in a specific way. Version 2 smart cards can have one TLV at minimum for the main card data that corresponds to the card type in the header. If the card type is not a deregistration card, the smart card can also contain an optional title TLV, which has to precede all other TLVs and contains text that will be displayed as a title in a dialog box when the smart card is inserted into the WebTV/MSN TV box. Multiple TLVs in general can be added if the card type isn't set to deregistration or if it is set as a "multi" card, which can perform several functions at once.

The general format for version 2 smart cards goes like this:

{| class="wikitable"
|-
! Offset
! Length
! Description
|-
| 0x00
| 1 byte
| Version identifier. Always <code>2</code> (0x32)
|-
| 0x01
| 1 byte
| Card type
|-
| 0x02
| 1 byte
| CRC value. This is an optional field and a value of 0xff can be specified to make WebTV/MSN TV ignore the CRC. The actual algorithm used for this CRC is currently unknown
|-
| 0x03
| Variable
| TLV data
|}

TLVs are simple structures that store data under a specified type. While constrained by the 122-byte limit for smart cards, they can theoretically hold up to 256 bytes of data. TLVs follow this format:

{| class="wikitable"
|-
! Field
! Length
! Description
|-
| Type
| 1 byte
| Type code
|-
| Length
| 1 byte
| 8-bit length of value
|-
| Value
| Variable
| Variable length value data
|}

==== Known Card Types ====
* A - '''A'''ffinity. This feature is currently undocumented, but involves an enrollment and program code
* F - '''F'''avorites
* W - Deregistration. Only the deregstration TLV can be present in the smart card data if this type is set
* O - '''O'''penISP (Use your own ISP)
* G - '''G'''o To (a website)
* M - Multi-card. Stores multiple TLVs to run several card functions at one time

==== Known TLVs ====
Below is a list of TLVs known to be used by the version 2 smart card format. TLVs will be listed by their type code.

===== "t" (Title) =====
* Description: Specifies a title to set for the smart card. Optional, but has to precede all other TLVs. This TLV can '''not''' be present in deregistration smart cards
* Value: The title for the smart card

===== "A" (Affinity data) =====
* Description: Required for Affinity smart cards
* Value: A byte for the version number (either <code>1</code> for version 1 Affinity data or <code>2</code> for version 2 Affinity data), followed by the actual data.
** For version 2 Affinity data: The format is the program code, a tab character (0x09), and the enrollment code
** For version 1 Affinity data: Just the enrollment code

===== "G" (Go To data) =====
* Description: Data that defines a website the smart card will make the box access. The wtv-smartcard service would have taken care of redirecting the client to the specified site if it existed. Required for "Go To" smart cards
* Value: A byte for the type of website to be accessed (<code>i</code> - Server-side numeric ID that will be translated by the WebTV/MSN TV service, <code>h</code> - HTTP URL, <code>s</code> - HTTPS URL), followed by a numeric ID if the type is <code>i</code>, or the direct URL for the site without the "http(s)://" prefix otherwise

===== "O" (OpenISP) =====
* Description: Data for setting up a predefined custom ISP to connect to WebTV/MSN TV with. Required for OpenISP smart cards
* Value: The character "1", followed by the ISP data separated with a tab character (0x09)

ISP information structure:
* ISP name - String
* 0x09 separator
* ISP login name - String
* 0x09 separator
* ISP password - String
* 0x09 separator
* Primary modem number - 10-digit phone number
* 0x09 separator
* Backup modem number - 10-digit phone number. Optional

===== "W" (Deregistration) =====
* Description: Data for de-registering a client. If this TLV is used, then the card type '''must''' be set to deregistration as well and no other TLVs may be added
* Value: Binary structure

Deregistration data structure:

{| class="wikitable"
|-
! Offset
! Length
! Description
|-
| 0x00
| 4 bytes
| Contains a specific sequence of bytes (in hex: <code>31 75 fa b0</code>). Purpose for these is unknown
|-
| 0x04
| 4 bytes
| A UNIX timestamp for when the deregistration card expires. On the WebTV smart card factory pages, this is always set to 0xffffffff to set it to not expire
|-
| 0x08
| Variable
| Deregistration code
|}

==== Format Example ====
The following example shows a break down of the data from an official Sony WebTV Plus smart card, which uses the version 2 smart card format and is a "Go to" card. The card would have originally sent to the service a site ID of 999999, which would redirect the user to the Sony-operated site <nowiki>http://www.svalue.com</nowiki> (no longer run by Sony).

{| class="wikitable"
|-
! Field
! Value
|-
| Version
| <code>2</code> (0x32)
|-
| Type
| <code>G</code> (Go to)
|-
| CRC
| 0xFF (Ignore)
|-
| TLV #1 Type
| <code>t</code> (Title)
|-
| TLV #1 Length
| 0x0B
|-
| TLV #1 Value
| "Sony Value "
|-
| TLV #2 Type
| <code>G</code> (Go to)
|-
| TLV #2 Length
| 0x07
|-
| TLV #2 Value
| "i999999" (Server-side numeric ID 999999 - pointed to <nowiki>http://www.svalue.com</nowiki> on the original server)
|}


== Client-Side ==

WebTV and MSN TV boxes have the ability to write to compatible smart cards inserted into their smart card slot. This is done with the client command <code>client:SaveToSmartCard?data={data}</code>, with <code>{data}</code> being the raw smart card data, which can be URL encoded if necessary.

User:Wtv-411/Smart Card

2023-08-05T19:55:58Z

Wtv-411: /* Format */ Remove TODO

{{WTVPNav}}

'''WIP'''

----

Smart Cards were used on the WebTV and first-generation MSN TV service to take the user to a site, set up ISP options, etc. They were rarely utilized, and were removed on the MSN TV 2.

WebTV/MSN TV boxes support smart cards that are compliant with the [https://en.wikipedia.org/wiki/ISO/IEC_7816 ISO-7816 standard]. Smart cards can hold up to 122 bytes of data.

== Inserting a smart card ==
When a smart card is inserted into the WebTV/MSN TV receiver, it will show a message on the screen with the smart card name and a progress bar. In the background, the box will contact the URL from the <code>wtv-smartcard-inserted-url</code> header sent from headwaiter, which is usually <code>wtv-smartcard:/insert</code>. The box will <code>POST</code> the raw data read from the card to the URL. While official clients can supposedly send the smart card data raw, it has only been documented to send the data as a Base64 encoded string with every 4 bytes swapped:

<pre>
POST wtv-smartcard:/insert\r\n
User-Agent: Mozilla/4.0 WebTV/2.6 (compatible; MSIE 4.0)\r\n
wtv-show-time-record: 4 <wtv-home:/home?>\r\n
wtv-request-type: primary\r\n
wtv-incarnation: 14\r\n
Content-type: application/octet-stream\r\n
Content-length: 36\r\n
\r\n
/fkMTtAd552bhZFIlVHbHcEI5kTa5kTO==QO
</pre>

<code>/fkMTtAd552bhZFIlVHbHcEI5kTa5kTO==QO -> Mkf/dAtTb255IFZhbHVlIEcHaTk5OTk5OQ==</code>

The server will unswap the bytes, decode the data into its raw binary form, and then parse it as smart card data to determine what to do with it. While the specifics of the <code>wtv-smartcard</code> service aren't well known, what is known is that the server will redirect the box to a website specified by the smart card if it is a "Go To" card, and send an error page if the data is invalid.

In some cases, the box will send an error header (e.g: "error=-68") if something goes wrong.

== Format ==

WebTV/MSN TV smart cards use a proprietary format to store data. There are two known versions of the format that WebTV Networks developed: version 1 and version 2. The only smart card known to be produced for WebTV boxes (the Sony smart card bundled with Sony WebTV Plus units) uses the version 2 format, though.

Thanks to internal WebTV pages from a "smart card factory" service containing JavaScript that directly handled writing in both formats, these formats have been able to be reverse engineered to varying degrees of success. This page will currently only cover the version 2 smart card format though, since that is the format we have the most information on.

=== Version 2 ===
Version 2 smart cards make use of a header and TLVs (type-length-value) to store data. A TLV performs one specific function based on the type specified and stores data in a specific way. Version 2 smart cards can have one TLV at minimum for the main card data that corresponds to the card type in the header. If the card type is not a deregistration card, the smart card can also contain an optional title TLV, which has to precede all other TLVs and contains text that will be displayed as a title in a dialog box when the smart card is inserted into the WebTV/MSN TV box. Multiple TLVs in general can be added if the card type isn't set to deregistration or if it is set as a "multi" card, which can perform several functions at once.

The general format for version 2 smart cards goes like this:

{| class="wikitable"
|-
! Offset
! Length
! Description
|-
| 0x00
| 1 byte
| Version identifier. Always <code>2</code> (0x32)
|-
| 0x01
| 1 byte
| Card type
|-
| 0x02
| 1 byte
| CRC value. This is an optional field and a value of 0xff can be specified to make WebTV/MSN TV ignore the CRC. The actual algorithm used for this CRC is currently unknown
|-
| 0x03
| Variable
| TLV data
|}

TLVs are simple structures that store data under a specified type. While constrained by the 122-byte limit for smart cards, they can theoretically hold up to 256 bytes of data. TLVs follow this format:

{| class="wikitable"
|-
! Field
! Length
! Description
|-
| Type
| 1 byte
| Type code
|-
| Length
| 1 byte
| 8-bit length of value
|-
| Value
| Variable
| Variable length value data
|}

==== Known Card Types ====
* A - '''A'''ffinity. This feature is currently undocumented, but involves an enrollment and program code
* F - '''F'''avorites
* W - Deregistration. Only the deregstration TLV can be present in the smart card data if this type is set
* O - '''O'''penISP (Use your own ISP)
* G - '''G'''o To (a website)
* M - Multi-card. Stores multiple TLVs to run several card functions at one time

==== Known TLVs ====
TLVs will be listed by their type code.

===== "t" (Title) =====
* Description: Specifies a title to give the smart card. Optional, but has to precede all other TLVs. This TLV can '''not''' be present in deregistration smart cards
* Value: The title for the smart card

===== "A" (Affinity data) =====
* Description: Required for Affinity smart cards
* Value: A byte for the version number (either <code>1</code> for version 1 Affinity data or <code>2</code> for version 2 Affinity data), followed by the actual data.
** For version 2 Affinity data: The format is the program code, a tab character (0x09), and the enrollment code
** For version 1 Affinity data: Just the enrollment code is added

===== "G" (Go To data) =====
* Description: Data that defines a website the smart card will make the box access. The wtv-smartcard service would have taken care of redirecting the client to the specified site if it existed. Required for "Go To" smart cards
* Value: A byte for the type of website to be accessed (<code>i</code> - Server-side numeric ID that will be translated by the WebTV/MSN TV service, <code>h</code> - HTTP URL, <code>s</code> - HTTPS URL), followed by a numeric ID if the type is <code>i</code>, or the direct URL for the site without the "http(s)://" prefix otherwise

===== "O" (OpenISP) =====
* Description: Data for setting up a predefined custom ISP to connect to WebTV/MSN TV with. Required for OpenISP smart cards
* Value: The character "1", followed by the ISP data separated with a tab character (0x09)

ISP information structure:
* ISP name - String
* 0x09 separator
* ISP login name - String
* 0x09 separator
* ISP password - String
* 0x09 separator
* Primary modem number - 10-digit phone number
* 0x09 separator
* Backup modem number - 10-digit phone number. Optional

===== "W" (Deregistration) =====
* Description: Data for de-registering a client. If this TLV is used, then the card type '''must''' be set to deregistration as well and no other TLVs may be added
* Value: Binary structure

Deregistration data structure:

{| class="wikitable"
|-
! Offset
! Length
! Description
|-
| 0x00
| 4 bytes
| Contains a specific sequence of bytes (in hex: <code>31 75 fa b0</code>). Purpose for these is unknown
|-
| 0x04
| 4 bytes
| A UNIX timestamp for when the deregistration card expires. On the WebTV smart card factory pages, this is always set to 0xffffffff to set it to not expire
|-
| 0x08
| Variable
| Deregistration code
|}

==== Format Example ====
The following example shows a break down of the data from an official Sony WebTV Plus smart card, which uses the version 2 smart card format and is a "Go to" card. The card would have originally sent to the service a site ID of 999999, which would redirect the user to the Sony-operated site <nowiki>http://www.svalue.com</nowiki> (no longer run by Sony).

{| class="wikitable"
|-
! Field
! Value
|-
| Version
| <code>2</code> (0x32)
|-
| Type
| <code>G</code> (Go to)
|-
| CRC
| 0xFF (Ignore)
|-
| TLV #1 Type
| <code>t</code> (Title)
|-
| TLV #1 Length
| 0x0B
|-
| TLV #1 Value
| "Sony Value "
|-
| TLV #2 Type
| </code>G</code> (Go to)
|-
| TLV #2 Length
| 0x07
|-
| TLV #2 Value
| "i999999" (Server-side numeric ID 999999 - pointed to <nowiki>http://www.svalue.com</nowiki> on the original server)
|}


== Client-Side ==

WebTV and MSN TV boxes have the ability to write to compatible smart cards inserted into their smart card slot. This is done with the client command <code>client:SaveToSmartCard?data={data}</code>, with <code>{data}</code> being the raw smart card data, which can be URL encoded if necessary.

User:Wtv-411/Smart Card

2023-08-05T19:55:31Z

Wtv-411: /* Version 2 */

{{WTVPNav}}

'''WIP'''

----

Smart Cards were used on the WebTV and first-generation MSN TV service to take the user to a site, set up ISP options, etc. They were rarely utilized, and were removed on the MSN TV 2.

WebTV/MSN TV boxes support smart cards that are compliant with the [https://en.wikipedia.org/wiki/ISO/IEC_7816 ISO-7816 standard]. Smart cards can hold up to 122 bytes of data.

== Inserting a smart card ==
When a smart card is inserted into the WebTV/MSN TV receiver, it will show a message on the screen with the smart card name and a progress bar. In the background, the box will contact the URL from the <code>wtv-smartcard-inserted-url</code> header sent from headwaiter, which is usually <code>wtv-smartcard:/insert</code>. The box will <code>POST</code> the raw data read from the card to the URL. While official clients can supposedly send the smart card data raw, it has only been documented to send the data as a Base64 encoded string with every 4 bytes swapped:

<pre>
POST wtv-smartcard:/insert\r\n
User-Agent: Mozilla/4.0 WebTV/2.6 (compatible; MSIE 4.0)\r\n
wtv-show-time-record: 4 <wtv-home:/home?>\r\n
wtv-request-type: primary\r\n
wtv-incarnation: 14\r\n
Content-type: application/octet-stream\r\n
Content-length: 36\r\n
\r\n
/fkMTtAd552bhZFIlVHbHcEI5kTa5kTO==QO
</pre>

<code>/fkMTtAd552bhZFIlVHbHcEI5kTa5kTO==QO -> Mkf/dAtTb255IFZhbHVlIEcHaTk5OTk5OQ==</code>

The server will unswap the bytes, decode the data into its raw binary form, and then parse it as smart card data to determine what to do with it. While the specifics of the <code>wtv-smartcard</code> service aren't well known, what is known is that the server will redirect the box to a website specified by the smart card if it is a "Go To" card, and send an error page if the data is invalid.

In some cases, the box will send an error header (e.g: "error=-68") if something goes wrong.

== Format ==

WebTV/MSN TV smart cards use a proprietary format to store data. There are two known versions of the format that WebTV Networks developed: version 1 and version 2. The only smart card known to be produced for WebTV boxes (the Sony smart card bundled with Sony WebTV Plus units) uses the version 2 format, though.

Thanks to internal WebTV pages from a "smart card factory" service containing JavaScript that directly handled writing in both formats, these formats have been able to be reverse engineered to varying degrees of success. This page will currently only cover the version 2 smart card format though, since that is the format we have the most information on.

=== Version 2 ===
Version 2 smart cards make use of a header and TLVs (type-length-value) to store data. A TLV performs one specific function based on the type specified and stores data in a specific way. Version 2 smart cards can have one TLV at minimum for the main card data that corresponds to the card type in the header. If the card type is not a deregistration card, the smart card can also contain an optional title TLV, which has to precede all other TLVs and contains text that will be displayed as a title in a dialog box when the smart card is inserted into the WebTV/MSN TV box. Multiple TLVs in general can be added if the card type isn't set to deregistration or if it is set as a "multi" card, which can perform several functions at once.

The general format for version 2 smart cards goes like this:

{| class="wikitable"
|-
! Offset
! Length
! Description
|-
| 0x00
| 1 byte
| Version identifier. Always <code>2</code> (0x32)
|-
| 0x01
| 1 byte
| Card type
|-
| 0x02
| 1 byte
| CRC value. This is an optional field and a value of 0xff can be specified to make WebTV/MSN TV ignore the CRC. The actual algorithm used for this CRC is currently unknown
|-
| 0x03
| Variable
| TLV data
|}

TLVs are simple structures that store data under a specified type. While constrained by the 122-byte limit for smart cards, they can theoretically hold up to 256 bytes of data. TLVs follow this format:

{| class="wikitable"
|-
! Field
! Length
! Description
|-
| Type
| 1 byte
| Type code
|-
| Length
| 1 byte
| 8-bit length of value
|-
| Value
| Variable
| Variable length value data
|}

==== Known Card Types ====
* A - '''A'''ffinity. This feature is currently undocumented, but involves an enrollment and program code
* F - '''F'''avorites
* W - Deregistration. Only the deregstration TLV can be present in the smart card data if this type is set
* O - '''O'''penISP (Use your own ISP)
* G - '''G'''o To (a website)
* M - Multi-card. Stores multiple TLVs to run several card functions at one time

==== Known TLVs ====
TLVs will be listed by their type code.

===== "t" (Title) =====
* Description: Specifies a title to give the smart card. Optional, but has to precede all other TLVs. This TLV can '''not''' be present in deregistration smart cards
* Value: The title for the smart card

===== "A" (Affinity data) =====
* Description: Required for Affinity smart cards
* Value: A byte for the version number (either <code>1</code> for version 1 Affinity data or <code>2</code> for version 2 Affinity data), followed by the actual data.
** For version 2 Affinity data: The format is the program code, a tab character (0x09), and the enrollment code
** For version 1 Affinity data: Just the enrollment code is added

===== "G" (Go To data) =====
* Description: Data that defines a website the smart card will make the box access. The wtv-smartcard service would have taken care of redirecting the client to the specified site if it existed. Required for "Go To" smart cards
* Value: A byte for the type of website to be accessed (<code>i</code> - Server-side numeric ID that will be translated by the WebTV/MSN TV service, <code>h</code> - HTTP URL, <code>s</code> - HTTPS URL), followed by a numeric ID if the type is <code>i</code>, or the direct URL for the site without the "http(s)://" prefix otherwise

===== "O" (OpenISP) =====
* Description: Data for setting up a predefined custom ISP to connect to WebTV/MSN TV with. Required for OpenISP smart cards
* Value: The character "1", followed by the ISP data separated with a tab character (0x09)

ISP information structure:
* ISP name - String
* 0x09 separator
* ISP login name - String
* 0x09 separator
* ISP password - String
* 0x09 separator
* Primary modem number - 10-digit phone number
* 0x09 separator
* Backup modem number - 10-digit phone number. Optional

===== "W" (Deregistration) =====
* Description: Data for de-registering a client. If this TLV is used, then the card type '''must''' be set to deregistration as well and no other TLVs may be added
* Value: Binary structure

Deregistration data structure:

{| class="wikitable"
|-
! Offset
! Length
! Description
|-
| 0x00
| 4 bytes
| Contains a specific sequence of bytes (in hex: <code>31 75 fa b0</code>). Purpose for these is unknown
|-
| 0x04
| 4 bytes
| A UNIX timestamp for when the deregistration card expires. On the WebTV smart card factory pages, this is always set to 0xffffffff to set it to not expire
|-
| 0x08
| Variable
| Deregistration code
|}

==== Format Example ====
The following example shows a break down of the data from an official Sony WebTV Plus smart card, which uses the version 2 smart card format and is a "Go to" card. The card would have originally sent to the service a site ID of 999999, which would redirect the user to the Sony-operated site <nowiki>http://www.svalue.com</nowiki> (no longer run by Sony).

{| class="wikitable"
|-
! Field
! Value
|-
| Version
| <code>2</code> (0x32)
|-
| Type
| <code>G</code> (Go to)
|-
| CRC
| 0xFF (Ignore)
|-
| TLV #1 Type
| <code>t</code> (Title)
|-
| TLV #1 Length
| 0x0B
|-
| TLV #1 Value
| "Sony Value "
|-
| TLV #2 Type
| </code>G</code> (Go to)
|-
| TLV #2 Length
| 0x07
|-
| TLV #2 Value
| "i999999" (Server-side numeric ID 999999 - pointed to <nowiki>http://www.svalue.com</nowiki> on the original server)
|}

'''TODO'''


== Client-Side ==

WebTV and MSN TV boxes have the ability to write to compatible smart cards inserted into their smart card slot. This is done with the client command <code>client:SaveToSmartCard?data={data}</code>, with <code>{data}</code> being the raw smart card data, which can be URL encoded if necessary.

User:Wtv-411/Smart Card

2023-08-05T19:44:11Z

Wtv-411: /* Inserting a smart card */

{{WTVPNav}}

'''WIP'''

----

Smart Cards were used on the WebTV and first-generation MSN TV service to take the user to a site, set up ISP options, etc. They were rarely utilized, and were removed on the MSN TV 2.

WebTV/MSN TV boxes support smart cards that are compliant with the [https://en.wikipedia.org/wiki/ISO/IEC_7816 ISO-7816 standard]. Smart cards can hold up to 122 bytes of data.

== Inserting a smart card ==
When a smart card is inserted into the WebTV/MSN TV receiver, it will show a message on the screen with the smart card name and a progress bar. In the background, the box will contact the URL from the <code>wtv-smartcard-inserted-url</code> header sent from headwaiter, which is usually <code>wtv-smartcard:/insert</code>. The box will <code>POST</code> the raw data read from the card to the URL. While official clients can supposedly send the smart card data raw, it has only been documented to send the data as a Base64 encoded string with every 4 bytes swapped:

<pre>
POST wtv-smartcard:/insert\r\n
User-Agent: Mozilla/4.0 WebTV/2.6 (compatible; MSIE 4.0)\r\n
wtv-show-time-record: 4 <wtv-home:/home?>\r\n
wtv-request-type: primary\r\n
wtv-incarnation: 14\r\n
Content-type: application/octet-stream\r\n
Content-length: 36\r\n
\r\n
/fkMTtAd552bhZFIlVHbHcEI5kTa5kTO==QO
</pre>

<code>/fkMTtAd552bhZFIlVHbHcEI5kTa5kTO==QO -> Mkf/dAtTb255IFZhbHVlIEcHaTk5OTk5OQ==</code>

The server will unswap the bytes, decode the data into its raw binary form, and then parse it as smart card data to determine what to do with it. While the specifics of the <code>wtv-smartcard</code> service aren't well known, what is known is that the server will redirect the box to a website specified by the smart card if it is a "Go To" card, and send an error page if the data is invalid.

In some cases, the box will send an error header (e.g: "error=-68") if something goes wrong.

== Format ==

WebTV/MSN TV smart cards use a proprietary format to store data. There are two known versions of the format that WebTV Networks developed: version 1 and version 2. The only smart card known to be produced for WebTV boxes (the Sony smart card bundled with Sony WebTV Plus units) uses the version 2 format, though.

Thanks to internal WebTV pages from a "smart card factory" service containing JavaScript that directly handled writing in both formats, these formats have been able to be reverse engineered to varying degrees of success. This page will currently only cover the version 2 smart card format though, since that is the format we have the most information on.

=== Version 2 ===
Version 2 smart cards make use of a header and TLVs (type-length-value) to store data. A TLV performs one specific function based on the type specified and stores data in a specific way. Version 2 smart cards can have one TLV at minimum for the main card data that corresponds to the card type in the header. If the card type is not a deregistration card, the smart card can also contain an optional title TLV, which has to precede all other TLVs and contains text that will be displayed as a title in a dialog box when the smart card is inserted into the WebTV/MSN TV box. Multiple TLVs in general can be added if the card type isn't set to deregistration or if it is set as a "multi" card, which can perform several functions at once.

The general format for version 2 smart cards goes like this:

{| class="wikitable"
|-
! Offset
! Length
! Description
|-
| 0x00
| 1 byte
| Version identifier. Always <code>2</code> (0x32)
|-
| 0x01
| 1 byte
| Card type
|-
| 0x02
| 1 byte
| CRC value. This is an optional field and a value of 0xff can be specified to make WebTV/MSN TV ignore the CRC. The actual algorithm used for this CRC is currently unknown
|-
| 0x03
| Variable
| TLV data
|}

TLVs are simple structures that store data under a specified type. They can technically hold up to 256 bytes of data, and follow this format:

{| class="wikitable"
|-
! Field
! Type
! Description
|-
| Type
| uint8
| Type code
|-
| Length
| uint8
| 8-bit length of value
|-
| Value
| Byte array
| Variable length value data
|}

==== Known Card Types ====
* A - '''A'''ffinity. This feature is currently undocumented, but involves an enrollment and program code
* F - '''F'''avorites
* W - Deregistration. Only the deregstration TLV can be present in the smart card data if this type is set
* O - '''O'''penISP (Use your own ISP)
* G - '''G'''o To (a website)
* M - Multi-card. Stores multiple TLVs to run several card functions at one time

==== Known TLVs ====
TLVs will be listed by their type code.

===== "t" (Title) =====
* Description: Specifies a title to give the smart card. Optional, but has to precede all other TLVs. This TLV can '''not''' be present in deregistration smart cards
* Value: The title for the smart card

===== "A" (Affinity data) =====
* Description: Required for Affinity smart cards
* Value: A byte for the version number (either <code>1</code> for version 1 Affinity data or <code>2</code> for version 2 Affinity data), followed by the actual data.
** For version 2 Affinity data: The format is the program code, a tab character (0x09), and the enrollment code
** For version 1 Affinity data: Just the enrollment code is added

===== "G" (Go To data) =====
* Description: Data that defines a website the smart card will make the box access. The wtv-smartcard service would have taken care of redirecting the client to the specified site if it existed. Required for "Go To" smart cards
* Value: A byte for the type of website to be accessed (<code>i</code> - Server-side numeric ID that will be translated by the WebTV/MSN TV service, <code>h</code> - HTTP URL, <code>s</code> - HTTPS URL), followed by a numeric ID if the type is <code>i</code>, or the direct URL for the site without the "http(s)://" prefix otherwise

===== "O" (OpenISP) =====
* Description: Data for setting up a predefined custom ISP to connect to WebTV/MSN TV with. Required for OpenISP smart cards
* Value: The character "1", followed by the ISP data separated with a tab character (0x09)

ISP information structure:
* ISP name - String
* 0x09 separator
* ISP login name - String
* 0x09 separator
* ISP password - String
* 0x09 separator
* Primary modem number - 10-digit phone number
* 0x09 separator
* Backup modem number - 10-digit phone number. Optional

===== "W" (Deregistration) =====
* Description: Data for de-registering a client. If this TLV is used, then the card type '''must''' be set to deregistration as well and no other TLVs may be added
* Value: Binary structure

Deregistration data structure:

{| class="wikitable"
|-
! Offset
! Length
! Description
|-
| 0x00
| 4 bytes
| Contains a specific sequence of bytes (in hex: <code>31 75 fa b0</code>). Purpose for these is unknown
|-
| 0x04
| 4 bytes
| A UNIX timestamp for when the deregistration card expires. On the WebTV smart card factory pages, this is always set to 0xffffffff to set it to not expire
|-
| 0x08
| Variable
| Deregistration code
|}

==== Example ====
The following example shows a break down of the data from an official Sony WebTV Plus smart card, which uses the version 2 smart card format and is a "Go to" card. The card would have originally sent to the service a site ID of 999999, which would redirect the user to the Sony-operated site <nowiki>http://www.svalue.com</nowiki> (no longer run by Sony).

{| class="wikitable"
|-
! Field
! Value
|-
| Version
| <code>2</code> (0x32)
|-
| Type
| <code>G</code> (Go to)
|-
| CRC
| 0xFF (Ignore)
|-
| TLV #1 Type
| <code>t</code> (Title)
|-
| TLV #1 Length
| 0x0B
|-
| TLV #1 Value
| "Sony Value "
|-
| TLV #2 Type
| </code>G</code> (Go to)
|-
| TLV #2 Length
| 0x07
|-
| TLV #2 Value
| "i999999" (Server-side numeric ID 999999 - pointed to <nowiki>http://www.svalue.com</nowiki> on the original server)
|}

'''TODO'''


== Client-Side ==

WebTV and MSN TV boxes have the ability to write to compatible smart cards inserted into their smart card slot. This is done with the client command <code>client:SaveToSmartCard?data={data}</code>, with <code>{data}</code> being the raw smart card data, which can be URL encoded if necessary.

User:Wtv-411/Smart Card

2023-08-05T19:43:44Z

Wtv-411: /* Inserting a smart card */

{{WTVPNav}}

'''WIP'''

----

Smart Cards were used on the WebTV and first-generation MSN TV service to take the user to a site, set up ISP options, etc. They were rarely utilized, and were removed on the MSN TV 2.

WebTV/MSN TV boxes support smart cards that are compliant with the [https://en.wikipedia.org/wiki/ISO/IEC_7816 ISO-7816 standard]. Smart cards can hold up to 122 bytes of data.

== Inserting a smart card ==
When a smart card is inserted into the WebTV/MSN TV receiver, it will show a message on the screen with the smart card name and a progress bar. In the background, the box will contact the URL from the <code>wtv-smartcard-inserted-url</code> header sent from headwaiter, which is usually <code>wtv-smartcard:/insert</code>. The box will <code>POST</code> the raw data read from the card to the URL. While official clients can supposedly send the smart card data raw, it has only been documented to send the data as a Base64 encoded string with every 4 bytes swapped:

<pre>
POST wtv-smartcard:/insert\r\n
User-Agent: Mozilla/4.0 WebTV/2.6 (compatible; MSIE 4.0)\r\n
wtv-show-time-record: 4 <wtv-home:/home?>\r\n
wtv-request-type: primary\r\n
wtv-incarnation: 14\r\n
Content-type: application/octet-stream\r\n
Content-length: 36\r\n
\r\n
/fkMTtAd552bhZFIlVHbHcEI5kTa5kTO==QO
</pre>

<code>/fkMTtAd552bhZFIlVHbHcEI5kTa5kTO==QO -> Mkf/dAtTb255IFZhbHVlIEcHaTk5OTk5OQ==</code>

The server will unswap the bytes, decode the data into its raw binary form, and then parse it as smart card data to determine what to do with it. While the specifics of the <code>wtv-smartcard</code> service aren't well known, what is known is that the server will redirect the box to a website specified by the smart card if it is a "Go To" card, and send an error page is the data is invalid.

In some cases, the box will send an error header (e.g: "error=-68") if something goes wrong.

== Format ==

WebTV/MSN TV smart cards use a proprietary format to store data. There are two known versions of the format that WebTV Networks developed: version 1 and version 2. The only smart card known to be produced for WebTV boxes (the Sony smart card bundled with Sony WebTV Plus units) uses the version 2 format, though.

Thanks to internal WebTV pages from a "smart card factory" service containing JavaScript that directly handled writing in both formats, these formats have been able to be reverse engineered to varying degrees of success. This page will currently only cover the version 2 smart card format though, since that is the format we have the most information on.

=== Version 2 ===
Version 2 smart cards make use of a header and TLVs (type-length-value) to store data. A TLV performs one specific function based on the type specified and stores data in a specific way. Version 2 smart cards can have one TLV at minimum for the main card data that corresponds to the card type in the header. If the card type is not a deregistration card, the smart card can also contain an optional title TLV, which has to precede all other TLVs and contains text that will be displayed as a title in a dialog box when the smart card is inserted into the WebTV/MSN TV box. Multiple TLVs in general can be added if the card type isn't set to deregistration or if it is set as a "multi" card, which can perform several functions at once.

The general format for version 2 smart cards goes like this:

{| class="wikitable"
|-
! Offset
! Length
! Description
|-
| 0x00
| 1 byte
| Version identifier. Always <code>2</code> (0x32)
|-
| 0x01
| 1 byte
| Card type
|-
| 0x02
| 1 byte
| CRC value. This is an optional field and a value of 0xff can be specified to make WebTV/MSN TV ignore the CRC. The actual algorithm used for this CRC is currently unknown
|-
| 0x03
| Variable
| TLV data
|}

TLVs are simple structures that store data under a specified type. They can technically hold up to 256 bytes of data, and follow this format:

{| class="wikitable"
|-
! Field
! Type
! Description
|-
| Type
| uint8
| Type code
|-
| Length
| uint8
| 8-bit length of value
|-
| Value
| Byte array
| Variable length value data
|}

==== Known Card Types ====
* A - '''A'''ffinity. This feature is currently undocumented, but involves an enrollment and program code
* F - '''F'''avorites
* W - Deregistration. Only the deregstration TLV can be present in the smart card data if this type is set
* O - '''O'''penISP (Use your own ISP)
* G - '''G'''o To (a website)
* M - Multi-card. Stores multiple TLVs to run several card functions at one time

==== Known TLVs ====
TLVs will be listed by their type code.

===== "t" (Title) =====
* Description: Specifies a title to give the smart card. Optional, but has to precede all other TLVs. This TLV can '''not''' be present in deregistration smart cards
* Value: The title for the smart card

===== "A" (Affinity data) =====
* Description: Required for Affinity smart cards
* Value: A byte for the version number (either <code>1</code> for version 1 Affinity data or <code>2</code> for version 2 Affinity data), followed by the actual data.
** For version 2 Affinity data: The format is the program code, a tab character (0x09), and the enrollment code
** For version 1 Affinity data: Just the enrollment code is added

===== "G" (Go To data) =====
* Description: Data that defines a website the smart card will make the box access. The wtv-smartcard service would have taken care of redirecting the client to the specified site if it existed. Required for "Go To" smart cards
* Value: A byte for the type of website to be accessed (<code>i</code> - Server-side numeric ID that will be translated by the WebTV/MSN TV service, <code>h</code> - HTTP URL, <code>s</code> - HTTPS URL), followed by a numeric ID if the type is <code>i</code>, or the direct URL for the site without the "http(s)://" prefix otherwise

===== "O" (OpenISP) =====
* Description: Data for setting up a predefined custom ISP to connect to WebTV/MSN TV with. Required for OpenISP smart cards
* Value: The character "1", followed by the ISP data separated with a tab character (0x09)

ISP information structure:
* ISP name - String
* 0x09 separator
* ISP login name - String
* 0x09 separator
* ISP password - String
* 0x09 separator
* Primary modem number - 10-digit phone number
* 0x09 separator
* Backup modem number - 10-digit phone number. Optional

===== "W" (Deregistration) =====
* Description: Data for de-registering a client. If this TLV is used, then the card type '''must''' be set to deregistration as well and no other TLVs may be added
* Value: Binary structure

Deregistration data structure:

{| class="wikitable"
|-
! Offset
! Length
! Description
|-
| 0x00
| 4 bytes
| Contains a specific sequence of bytes (in hex: <code>31 75 fa b0</code>). Purpose for these is unknown
|-
| 0x04
| 4 bytes
| A UNIX timestamp for when the deregistration card expires. On the WebTV smart card factory pages, this is always set to 0xffffffff to set it to not expire
|-
| 0x08
| Variable
| Deregistration code
|}

==== Example ====
The following example shows a break down of the data from an official Sony WebTV Plus smart card, which uses the version 2 smart card format and is a "Go to" card. The card would have originally sent to the service a site ID of 999999, which would redirect the user to the Sony-operated site <nowiki>http://www.svalue.com</nowiki> (no longer run by Sony).

{| class="wikitable"
|-
! Field
! Value
|-
| Version
| <code>2</code> (0x32)
|-
| Type
| <code>G</code> (Go to)
|-
| CRC
| 0xFF (Ignore)
|-
| TLV #1 Type
| <code>t</code> (Title)
|-
| TLV #1 Length
| 0x0B
|-
| TLV #1 Value
| "Sony Value "
|-
| TLV #2 Type
| </code>G</code> (Go to)
|-
| TLV #2 Length
| 0x07
|-
| TLV #2 Value
| "i999999" (Server-side numeric ID 999999 - pointed to <nowiki>http://www.svalue.com</nowiki> on the original server)
|}

'''TODO'''


== Client-Side ==

WebTV and MSN TV boxes have the ability to write to compatible smart cards inserted into their smart card slot. This is done with the client command <code>client:SaveToSmartCard?data={data}</code>, with <code>{data}</code> being the raw smart card data, which can be URL encoded if necessary.

User:Wtv-411/Smart Card

2023-08-05T19:18:40Z

Wtv-411: Refine more stuff

{{WTVPNav}}

'''WIP'''

----

Smart Cards were used on the WebTV and first-generation MSN TV service to take the user to a site, set up ISP options, etc. They were rarely utilized, and were removed on the MSN TV 2.

WebTV/MSN TV boxes support smart cards that are compliant with the [https://en.wikipedia.org/wiki/ISO/IEC_7816 ISO-7816 standard]. Smart cards can hold up to 122 bytes of data.

== Inserting a smart card ==
When a smart card is inserted into the WebTV/MSN TV receiver, it will show a message on the screen with the smart card name and a progress bar. In the background, the box will contact the URL from the <code>wtv-smartcard-inserted-url</code> header sent from headwaiter, which is usually <code>wtv-smartcard:/insert</code>. The box will <code>POST</code> the raw data read from the card to the URL. While official clients can supposedly send the smart card data raw, it has only been documented to send the data as a Base64 encoded string with every 4 bytes swapped:

<pre>
POST wtv-smartcard:/insert\r\n
User-Agent: Mozilla/4.0 WebTV/2.6 (compatible; MSIE 4.0)\r\n
wtv-show-time-record: 4 <wtv-home:/home?>\r\n
wtv-request-type: primary\r\n
wtv-incarnation: 14\r\n
Content-type: application/octet-stream\r\n
Content-length: 36\r\n
\r\n
/fkMTtAd552bhZFIlVHbHcEI5kTa5kTO==QO
</pre>

<code>/fkMTtAd552bhZFIlVHbHcEI5kTa5kTO==QO -> Mkf/dAtTb255IFZhbHVlIEcHaTk5OTk5OQ==</code>

The server will unswap the bytes, decode the data into its raw binary form, and then parse it as smart card data to determine what to do with it. While the specifics of the <code>wtv-smartcard</code> aren't well known, what is known is that the server will redirect the box to the website if the smart card data is for a "Go To" card and send an error page is the data is invalid.

In some cases, the box will send an error header (e.g: "error=-68") if something goes wrong.

== Format ==

WebTV/MSN TV smart cards use a proprietary format to store data. There are two known versions of the format that WebTV Networks developed: version 1 and version 2. The only smart card known to be produced for WebTV boxes (the Sony smart card bundled with Sony WebTV Plus units) uses the version 2 format, though.

Thanks to internal WebTV pages from a "smart card factory" service containing JavaScript that directly handled writing in both formats, these formats have been able to be reverse engineered to varying degrees of success. This page will currently only cover the version 2 smart card format though, since that is the format we have the most information on.

=== Version 2 ===
Version 2 smart cards make use of a header and TLVs (type-length-value) to store data. A TLV performs one specific function based on the type specified and stores data in a specific way. Version 2 smart cards can have one TLV at minimum for the main card data that corresponds to the card type in the header. If the card type is not a deregistration card, the smart card can also contain an optional title TLV, which has to precede all other TLVs and contains text that will be displayed as a title in a dialog box when the smart card is inserted into the WebTV/MSN TV box. Multiple TLVs in general can be added if the card type isn't set to deregistration or if it is set as a "multi" card, which can perform several functions at once.

The general format for version 2 smart cards goes like this:

{| class="wikitable"
|-
! Offset
! Length
! Description
|-
| 0x00
| 1 byte
| Version identifier. Always <code>2</code> (0x32)
|-
| 0x01
| 1 byte
| Card type
|-
| 0x02
| 1 byte
| CRC value. This is an optional field and a value of 0xff can be specified to make WebTV/MSN TV ignore the CRC. The actual algorithm used for this CRC is currently unknown
|-
| 0x03
| Variable
| TLV data
|}

TLVs are simple structures that store data under a specified type. They can technically hold up to 256 bytes of data, and follow this format:

{| class="wikitable"
|-
! Field
! Type
! Description
|-
| Type
| uint8
| Type code
|-
| Length
| uint8
| 8-bit length of value
|-
| Value
| Byte array
| Variable length value data
|}

==== Known Card Types ====
* A - '''A'''ffinity. This feature is currently undocumented, but involves an enrollment and program code
* F - '''F'''avorites
* W - Deregistration. Only the deregstration TLV can be present in the smart card data if this type is set
* O - '''O'''penISP (Use your own ISP)
* G - '''G'''o To (a website)
* M - Multi-card. Stores multiple TLVs to run several card functions at one time

==== Known TLVs ====
TLVs will be listed by their type code.

===== "t" (Title) =====
* Description: Specifies a title to give the smart card. Optional, but has to precede all other TLVs. This TLV can '''not''' be present in deregistration smart cards
* Value: The title for the smart card

===== "A" (Affinity data) =====
* Description: Required for Affinity smart cards
* Value: A byte for the version number (either <code>1</code> for version 1 Affinity data or <code>2</code> for version 2 Affinity data), followed by the actual data.
** For version 2 Affinity data: The format is the program code, a tab character (0x09), and the enrollment code
** For version 1 Affinity data: Just the enrollment code is added

===== "G" (Go To data) =====
* Description: Data that defines a website the smart card will make the box access. The wtv-smartcard service would have taken care of redirecting the client to the specified site if it existed. Required for "Go To" smart cards
* Value: A byte for the type of website to be accessed (<code>i</code> - Server-side numeric ID that will be translated by the WebTV/MSN TV service, <code>h</code> - HTTP URL, <code>s</code> - HTTPS URL), followed by a numeric ID if the type is <code>i</code>, or the direct URL for the site without the "http(s)://" prefix otherwise

===== "O" (OpenISP) =====
* Description: Data for setting up a predefined custom ISP to connect to WebTV/MSN TV with. Required for OpenISP smart cards
* Value: The character "1", followed by the ISP data separated with a tab character (0x09)

ISP information structure:
* ISP name - String
* 0x09 separator
* ISP login name - String
* 0x09 separator
* ISP password - String
* 0x09 separator
* Primary modem number - 10-digit phone number
* 0x09 separator
* Backup modem number - 10-digit phone number. Optional

===== "W" (Deregistration) =====
* Description: Data for de-registering a client. If this TLV is used, then the card type '''must''' be set to deregistration as well and no other TLVs may be added
* Value: Binary structure

Deregistration data structure:

{| class="wikitable"
|-
! Offset
! Length
! Description
|-
| 0x00
| 4 bytes
| Contains a specific sequence of bytes (in hex: <code>31 75 fa b0</code>). Purpose for these is unknown
|-
| 0x04
| 4 bytes
| A UNIX timestamp for when the deregistration card expires. On the WebTV smart card factory pages, this is always set to 0xffffffff to set it to not expire
|-
| 0x08
| Variable
| Deregistration code
|}

==== Example ====
The following example shows a break down of the data from an official Sony WebTV Plus smart card, which uses the version 2 smart card format and is a "Go to" card. The card would have originally sent to the service a site ID of 999999, which would redirect the user to the Sony-operated site <nowiki>http://www.svalue.com</nowiki> (no longer run by Sony).

{| class="wikitable"
|-
! Field
! Value
|-
| Version
| <code>2</code> (0x32)
|-
| Type
| <code>G</code> (Go to)
|-
| CRC
| 0xFF (Ignore)
|-
| TLV #1 Type
| <code>t</code> (Title)
|-
| TLV #1 Length
| 0x0B
|-
| TLV #1 Value
| "Sony Value "
|-
| TLV #2 Type
| </code>G</code> (Go to)
|-
| TLV #2 Length
| 0x07
|-
| TLV #2 Value
| "i999999" (Server-side numeric ID 999999 - pointed to <nowiki>http://www.svalue.com</nowiki> on the original server)
|}

'''TODO'''


== Client-Side ==

WebTV and MSN TV boxes have the ability to write to compatible smart cards inserted into their smart card slot. This is done with the client command <code>client:SaveToSmartCard?data={data}</code>, with <code>{data}</code> being the raw smart card data, which can be URL encoded if necessary.

User:Wtv-411/Smart Card

2023-08-05T19:02:56Z

Wtv-411: /* Version 2 */

{{WTVPNav}}

'''WIP'''

----

Smart Cards were used on the WebTV and first-generation MSN TV service to take the user to a site, set up ISP options, etc. They were rarely utilized, and were removed on the MSN TV 2.

WebTV/MSN TV boxes support smart cards that are compliant with the ISO-7816 standard. Smart cards can hold up to 122 bytes of data.

== Inserting a smart card ==
When a smart card is inserted into the WebTV/MSN TV receiver, it will show a message on the screen with the smart card name and a progress bar. In the background, the box will contact the URL from the <code>wtv-smartcard-inserted-url</code> header sent from headwaiter, which is usually <code>wtv-smartcard:/insert</code>. The box will <code>POST</code> the raw data read from the card to the URL. While official clients can supposedly send the smart card data raw, it has only been documented to send the data as a Base64 encoded string with every 4 bytes swapped:

<pre>
POST wtv-smartcard:/insert\r\n
User-Agent: Mozilla/4.0 WebTV/2.6 (compatible; MSIE 4.0)\r\n
wtv-show-time-record: 4 <wtv-home:/home?>\r\n
wtv-request-type: primary\r\n
wtv-incarnation: 14\r\n
Content-type: application/octet-stream\r\n
Content-length: 36\r\n
\r\n
/fkMTtAd552bhZFIlVHbHcEI5kTa5kTO==QO
</pre>

<code>/fkMTtAd552bhZFIlVHbHcEI5kTa5kTO==QO -> Mkf/dAtTb255IFZhbHVlIEcHaTk5OTk5OQ==</code>

The server will unswap the bytes, decode the data into its raw binary form, and then parse it as smart card data to determine what to do with it. While the specifics of the <code>wtv-smartcard</code> aren't well known, what is known is that the server will redirect the box to the website if the smart card data is for a "Go To" card and send an error page is the data is invalid.

In some cases, the box will send an error header (e.g: "error=-68") if something goes wrong.

== Format ==

WebTV/MSN TV smart cards use a proprietary format to store data. There are two known versions of the format that WebTV Networks developed: version 1 and version 2. The only smart card known to be produced for WebTV boxes (the Sony smart card bundled with Sony INT-W200 Internet Terminals) uses the version 2 format, though.

Thanks to internal WebTV pages from a "smart card factory" service containing JavaScript that directly handled writing in both formats, these formats have been able to be reverse engineered to varying degrees of success. This page will currently only cover the version 2 smart card format though, since that is the format we have the most information on.

=== Version 2 ===
Version 2 smart cards make use of a header and TLVs (type-length-value) to store data. A TLV performs one specific function based on the type specified and stores data in a specific way. Version 2 smart cards can have one TLV at minimum for the main card data that corresponds to the card type in the header. If the card type is not a deregistration card, the smart card can also contain an optional title TLV, which has to precede all other TLVs and contains text that will be displayed as a title in a dialog box when the smart card is inserted into the WebTV/MSN TV box. Multiple TLVs in general can be added if the card type isn't set to deregistration or if it is set as a "multi" card, which can perform several functions at once.

The general format for version 2 smart cards goes like this:

{| class="wikitable"
|-
! Offset
! Length
! Description
|-
| 0x00
| 1 byte
| Version identifier. Always <code>2</code> (0x32)
|-
| 0x01
| 1 byte
| Card type
|-
| 0x02
| 1 byte
| CRC value. This is an optional field and a value of 0xff can be specified to make WebTV/MSN TV ignore the CRC. The actual algorithm used for this CRC is currently unknown
|-
| 0x03
| Variable
| TLV data
|}

TLVs are simple structures that store data under a specified type. They can technically hold up to 256 bytes of data, and follow this format:

{| class="wikitable"
|-
! Field
! Type
! Description
|-
| Type
| uint8
| Type code
|-
| Length
| uint8
| 8-bit length of value
|-
| Value
| Byte array
| Variable length value data
|}

==== Known Card Types ====
* A - '''A'''ffinity. This feature is currently undocumented, but involves an enrollment and program code
* F - '''F'''avorites
* W - Deregistration. Only the deregstration TLV can be present in the smart card data if this type is set
* O - '''O'''penISP (Use your own ISP)
* G - '''G'''o To (a website)
* M - Multi-card. Stores multiple TLVs to run several card functions at one time

==== Known TLVs ====
TLVs will be listed by their type code.

===== "t" (Title) =====
* Description: Specifies a title to give the smart card. Optional, but has to precede all other TLVs. This TLV can '''not''' be present in deregistration smart cards
* Value: The title for the smart card

===== "A" (Affinity data) =====
* Description: Required for Affinity smart cards
* Value: A byte for the version number (either <code>1</code> for version 1 Affinity data or <code>2</code> for version 2 Affinity data), followed by the actual data.
** For version 2 Affinity data: The format is the program code, a tab character (0x09), and the enrollment code
** For version 1 Affinity data: Just the enrollment code is added

===== "G" (Go To data) =====
* Description: Data that defines a website the smart card will make the box access. The wtv-smartcard service would have taken care of redirecting the client to the specified site if it existed. Required for "Go To" smart cards
* Value: A byte for the type of website to be accessed (<code>i</code> - Server-side numeric ID that will be translated by the WebTV/MSN TV service, <code>h</code> - HTTP URL, <code>s</code> - HTTPS URL), followed by a numeric ID if the type is <code>i</code>, or the direct URL for the site without the "http(s)://" prefix.

===== "O" (OpenISP) =====
* Description: Data for setting up a predefined custom ISP to connect to WebTV/MSN TV with. Required for OpenISP smart cards
* Value: "1", followed by the ISP data separated with a tab character (0x09)

ISP information structure:
* ISP name - String
* 0x09 separator
* ISP login name - String
* 0x09 separator
* ISP password - String
* 0x09 separator
* Primary modem number - 10-digit phone number
* 0x09 separator
* Backup modem number - 10-digit phone number. Optional

===== "W" (Deregistration) =====
* Description: Data for de-registering a client. If this TLV is used, then the card type '''must''' be set to deregistration as well and no other TLVs may be added
* Value: Binary structure

Deregistration data structure:

{| class="wikitable"
|-
! Offset
! Length
! Description
|-
| 0x00
| 4 bytes
| Contains a specific sequence of bytes (in hex: <code>31 75 fa b0</code>). Purpose for these is unknown
|-
| 0x04
| 4 bytes
| A UNIX timestamp for when the deregistration card expires. On the WebTV smart card factory pages, this is always set to 0xffffffff to set it to not expire
|-
| 0x08
| Variable
| Deregistration code
|}

==== Example ====
The following example shows a break down of the data from an official Sony INT-W200 smart card, which uses the version 2 smart card format and is a "Go to" card. The card would have originally sent to the service a site ID of 999999, which would redirect the user to the Sony-operated site <nowiki>http://svalue.com</nowiki> (no longer run by Sony).

{| class="wikitable"
|-
! Field
! Value
|-
| Version
| "2" (0x32)
|-
| Type
| "G" (Go to)
|-
| CRC
| 0xFF (Ignore)
|-
| TLV #1 Type
| "t" (Title)
|-
| TLV #1 Length
| 0x0B
|-
| TLV #1 Value
| "Sony Value "
|-
| TLV #2 Type
| "G" (Go to)
|-
| TLV #2 Length
| 0x07
|-
| TLV #2 Value
| "i999999" (Server-side numeric ID 999999 - points to <nowiki>http://svalue.com</nowiki> on the original server)
|}

'''TODO'''


== Client-Side ==

WebTV and MSN TV boxes have the ability to write to compatible smart cards inserted into their smart card slot. This is done with the client command <code>client:SaveToSmartCard?data={data}</code>, with <code>{data}</code> being the raw smart card data, which can be URL encoded if necessary.

User:Wtv-411/Smart Card

2023-08-05T18:59:31Z

Wtv-411: Add section to mention SaveToSmartCard client command

{{WTVPNav}}

'''WIP'''

----

Smart Cards were used on the WebTV and first-generation MSN TV service to take the user to a site, set up ISP options, etc. They were rarely utilized, and were removed on the MSN TV 2.

WebTV/MSN TV boxes support smart cards that are compliant with the ISO-7816 standard. Smart cards can hold up to 122 bytes of data.

== Inserting a smart card ==
When a smart card is inserted into the WebTV/MSN TV receiver, it will show a message on the screen with the smart card name and a progress bar. In the background, the box will contact the URL from the <code>wtv-smartcard-inserted-url</code> header sent from headwaiter, which is usually <code>wtv-smartcard:/insert</code>. The box will <code>POST</code> the raw data read from the card to the URL. While official clients can supposedly send the smart card data raw, it has only been documented to send the data as a Base64 encoded string with every 4 bytes swapped:

<pre>
POST wtv-smartcard:/insert\r\n
User-Agent: Mozilla/4.0 WebTV/2.6 (compatible; MSIE 4.0)\r\n
wtv-show-time-record: 4 <wtv-home:/home?>\r\n
wtv-request-type: primary\r\n
wtv-incarnation: 14\r\n
Content-type: application/octet-stream\r\n
Content-length: 36\r\n
\r\n
/fkMTtAd552bhZFIlVHbHcEI5kTa5kTO==QO
</pre>

<code>/fkMTtAd552bhZFIlVHbHcEI5kTa5kTO==QO -> Mkf/dAtTb255IFZhbHVlIEcHaTk5OTk5OQ==</code>

The server will unswap the bytes, decode the data into its raw binary form, and then parse it as smart card data to determine what to do with it. While the specifics of the <code>wtv-smartcard</code> aren't well known, what is known is that the server will redirect the box to the website if the smart card data is for a "Go To" card and send an error page is the data is invalid.

In some cases, the box will send an error header (e.g: "error=-68") if something goes wrong.

== Format ==

WebTV/MSN TV smart cards use a proprietary format to store data. There are two known versions of the format that WebTV Networks developed: version 1 and version 2. The only smart card known to be produced for WebTV boxes (the Sony smart card bundled with Sony INT-W200 Internet Terminals) uses the version 2 format, though.

Thanks to internal WebTV pages from a "smart card factory" service containing JavaScript that directly handled writing in both formats, these formats have been able to be reverse engineered to varying degrees of success. This page will currently only cover the version 2 smart card format though, since that is the format we have the most information on.

=== Version 2 ===
Version 2 smart cards make use of a header and TLVs (type-length-value) to store data. A TLV performs one specific function based on the type specified and stores data in a specific way. Version 2 smart cards can have one TLV at minimum for the main card data that corresponds to the card type in the header. If the card type is not a deregistration card, the smart card can also contain an optional title TLV, which has to precede all other TLVs and contains text that will be displayed as a title in a dialog box when the smart card is inserted into the WebTV/MSN TV box. Multiple TLVs in general can be added if the card type isn't set to deregistration or if it is set as a "multi" card, which can perform several functions at once.

The general format for version 2 smart cards goes like this:

{| class="wikitable"
|-
! Offset
! Length
! Description
|-
| 0x00
| 1 byte
| Version identifier. Always <code>2</code> (0x32)
|-
| 0x01
| 1 byte
| Card type
|-
| 0x02
| 1 byte
| CRC value. This is an optional field and a value of 0xff can be specified to make WebTV/MSN TV ignore the CRC
|-
| 0x03
| Variable
| TLV data
|}

TLVs are simple structures that store data under a specified type. They can technically hold up to 256 bytes of data, and follow this format:

{| class="wikitable"
|-
! Field
! Type
! Description
|-
| Type
| uint8
| Type code
|-
| Length
| uint8
| 8-bit length of value
|-
| Value
| Byte array
| Variable length value data
|}

==== Known Card Types ====
* A - '''A'''ffinity. This feature is currently undocumented, but involves an enrollment and program code
* F - '''F'''avorites
* W - Deregistration. Only the deregstration TLV can be present in the smart card data if this type is set
* O - '''O'''penISP (Use your own ISP)
* G - '''G'''o To (a website)
* M - Multi-card. Stores multiple TLVs to run several card functions at one time

==== Known TLVs ====
TLVs will be listed by their type code.

===== "t" (Title) =====
* Description: Specifies a title to give the smart card. Optional, but has to precede all other TLVs. This TLV can '''not''' be present in deregistration smart cards
* Value: The title for the smart card

===== "A" (Affinity data) =====
* Description: Required for Affinity smart cards
* Value: A byte for the version number (either <code>1</code> for version 1 Affinity data or <code>2</code> for version 2 Affinity data), followed by the actual data.
** For version 2 Affinity data: The format is the program code, a tab character (0x09), and the enrollment code
** For version 1 Affinity data: Just the enrollment code is added

===== "G" (Go To data) =====
* Description: Data that defines a website the smart card will make the box access. The wtv-smartcard service would have taken care of redirecting the client to the specified site if it existed. Required for "Go To" smart cards
* Value: A byte for the type of website to be accessed (<code>i</code> - Server-side numeric ID that will be translated by the WebTV/MSN TV service, <code>h</code> - HTTP URL, <code>s</code> - HTTPS URL), followed by a numeric ID if the type is <code>i</code>, or the direct URL for the site without the "http(s)://" prefix.

===== "O" (OpenISP) =====
* Description: Data for setting up a predefined custom ISP to connect to WebTV/MSN TV with. Required for OpenISP smart cards
* Value: "1", followed by the ISP data separated with a tab character (0x09)

ISP information structure:
* ISP name - String
* 0x09 separator
* ISP login name - String
* 0x09 separator
* ISP password - String
* 0x09 separator
* Primary modem number - 10-digit phone number
* 0x09 separator
* Backup modem number - 10-digit phone number. Optional

===== "W" (Deregistration) =====
* Description: Data for de-registering a client. If this TLV is used, then the card type '''must''' be set to deregistration as well and no other TLVs may be added
* Value: Binary structure

Deregistration data structure:

{| class="wikitable"
|-
! Offset
! Length
! Description
|-
| 0x00
| 4 bytes
| Contains a specific sequence of bytes (in hex: <code>31 75 fa b0</code>). Purpose for these is unknown
|-
| 0x04
| 4 bytes
| A UNIX timestamp for when the deregistration card expires. On the WebTV smart card factory pages, this is always set to 0xffffffff to set it to not expire
|-
| 0x08
| Variable
| Deregistration code
|}

==== Example ====
The following example shows a break down of the data from an official Sony INT-W200 smart card, which uses the version 2 smart card format and is a "Go to" card. The card would have originally sent to the service a site ID of 999999, which would redirect the user to the Sony-operated site <nowiki>http://svalue.com</nowiki> (no longer run by Sony).

{| class="wikitable"
|-
! Field
! Value
|-
| Version
| "2" (0x32)
|-
| Type
| "G" (Go to)
|-
| CRC
| 0xFF (Ignore)
|-
| TLV #1 Type
| "t" (Title)
|-
| TLV #1 Length
| 0x0B
|-
| TLV #1 Value
| "Sony Value "
|-
| TLV #2 Type
| "G" (Go to)
|-
| TLV #2 Length
| 0x07
|-
| TLV #2 Value
| "i999999" (Server-side numeric ID 999999 - points to <nowiki>http://svalue.com</nowiki> on the original server)
|}

'''TODO'''


== Client-Side ==

WebTV and MSN TV boxes have the ability to write to compatible smart cards inserted into their smart card slot. This is done with the client command <code>client:SaveToSmartCard?data={data}</code>, with <code>{data}</code> being the raw smart card data, which can be URL encoded if necessary.

User:Wtv-411/Smart Card

2023-08-05T18:50:57Z

Wtv-411: /* Service Side */

{{WTVPNav}}

'''WIP'''

----

Smart Cards were used on the WebTV and first-generation MSN TV service to take the user to a site, set up ISP options, etc. They were rarely utilized, and were removed on the MSN TV 2.

WebTV/MSN TV boxes support smart cards that are compliant with the ISO-7816 standard. Smart cards can hold up to 122 bytes of data.

== Service Side ==
When a smart card is inserted into the WebTV/MSN TV receiver, it will show a message on the screen with the smart card name and a progress bar. In the background, the box will contact the URL from the <code>wtv-smartcard-inserted-url</code> header sent from headwaiter, which is usually <code>wtv-smartcard:/insert</code>. The box will <code>POST</code> the raw data read from the card to the URL. While official clients can supposedly send the smart card data raw, it has only been documented to send the data as a Base64 encoded string with every 4 bytes swapped:

<pre>
POST wtv-smartcard:/insert\r\n
User-Agent: Mozilla/4.0 WebTV/2.6 (compatible; MSIE 4.0)\r\n
wtv-show-time-record: 4 <wtv-home:/home?>\r\n
wtv-request-type: primary\r\n
wtv-incarnation: 14\r\n
Content-type: application/octet-stream\r\n
Content-length: 36\r\n
\r\n
/fkMTtAd552bhZFIlVHbHcEI5kTa5kTO==QO
</pre>

<code>/fkMTtAd552bhZFIlVHbHcEI5kTa5kTO==QO -> Mkf/dAtTb255IFZhbHVlIEcHaTk5OTk5OQ==</code>

The server will unswap the bytes, decode the data into its raw binary form, and then parse it as smart card data to determine what to do with it. While the specifics of the <code>wtv-smartcard</code> aren't well known, what is known is that the server will redirect the box to the website if the smart card data is for a "Go To" card and send an error page is the data is invalid.

In some cases, the box will send an error header (e.g: "error=-68") if something goes wrong.

== Format ==

WebTV/MSN TV smart cards use a proprietary format to store data. There are two known versions of the format that WebTV Networks developed: version 1 and version 2. The only smart card known to be produced for WebTV boxes (the Sony smart card bundled with Sony INT-W200 Internet Terminals) uses the version 2 format, though.

Thanks to internal WebTV pages from a "smart card factory" service containing JavaScript that directly handled writing in both formats, these formats have been able to be reverse engineered to varying degrees of success. This page will currently only cover the version 2 smart card format though, since that is the format we have the most information on.

=== Version 2 ===
Version 2 smart cards make use of a header and TLVs (type-length-value) to store data. A TLV performs one specific function based on the type specified and stores data in a specific way. Version 2 smart cards can have one TLV at minimum for the main card data that corresponds to the card type in the header. If the card type is not a deregistration card, the smart card can also contain an optional title TLV, which has to precede all other TLVs and contains text that will be displayed as a title in a dialog box when the smart card is inserted into the WebTV/MSN TV box. Multiple TLVs in general can be added if the card type isn't set to deregistration or if it is set as a "multi" card, which can perform several functions at once.

The general format for version 2 smart cards goes like this:

{| class="wikitable"
|-
! Offset
! Length
! Description
|-
| 0x00
| 1 byte
| Version identifier. Always <code>2</code> (0x32)
|-
| 0x01
| 1 byte
| Card type
|-
| 0x02
| 1 byte
| CRC value. This is an optional field and a value of 0xff can be specified to make WebTV/MSN TV ignore the CRC
|-
| 0x03
| Variable
| TLV data
|}

TLVs are simple structures that store data under a specified type. They can technically hold up to 256 bytes of data, and follow this format:

{| class="wikitable"
|-
! Field
! Type
! Description
|-
| Type
| uint8
| Type code
|-
| Length
| uint8
| 8-bit length of value
|-
| Value
| Byte array
| Variable length value data
|}

==== Known Card Types ====
* A - '''A'''ffinity. This feature is currently undocumented, but involves an enrollment and program code
* F - '''F'''avorites
* W - Deregistration. Only the deregstration TLV can be present in the smart card data if this type is set
* O - '''O'''penISP (Use your own ISP)
* G - '''G'''o To (a website)
* M - Multi-card. Stores multiple TLVs to run several card functions at one time

==== Known TLVs ====
TLVs will be listed by their type code.

===== "t" (Title) =====
* Description: Specifies a title to give the smart card. Optional, but has to precede all other TLVs. This TLV can '''not''' be present in deregistration smart cards
* Value: The title for the smart card

===== "A" (Affinity data) =====
* Description: Required for Affinity smart cards
* Value: A byte for the version number (either <code>1</code> for version 1 Affinity data or <code>2</code> for version 2 Affinity data), followed by the actual data.
** For version 2 Affinity data: The format is the program code, a tab character (0x09), and the enrollment code
** For version 1 Affinity data: Just the enrollment code is added

===== "G" (Go To data) =====
* Description: Data that defines a website the smart card will make the box access. The wtv-smartcard service would have taken care of redirecting the client to the specified site if it existed. Required for "Go To" smart cards
* Value: A byte for the type of website to be accessed (<code>i</code> - Server-side numeric ID that will be translated by the WebTV/MSN TV service, <code>h</code> - HTTP URL, <code>s</code> - HTTPS URL), followed by a numeric ID if the type is <code>i</code>, or the direct URL for the site without the "http(s)://" prefix.

===== "O" (OpenISP) =====
* Description: Data for setting up a predefined custom ISP to connect to WebTV/MSN TV with. Required for OpenISP smart cards
* Value: "1", followed by the ISP data separated with a tab character (0x09)

ISP information structure:
* ISP name - String
* 0x09 separator
* ISP login name - String
* 0x09 separator
* ISP password - String
* 0x09 separator
* Primary modem number - 10-digit phone number
* 0x09 separator
* Backup modem number - 10-digit phone number. Optional

===== "W" (Deregistration) =====
* Description: Data for de-registering a client. If this TLV is used, then the card type '''must''' be set to deregistration as well and no other TLVs may be added
* Value: Binary structure

Deregistration data structure:

{| class="wikitable"
|-
! Offset
! Length
! Description
|-
| 0x00
| 4 bytes
| Contains a specific sequence of bytes (in hex: <code>31 75 fa b0</code>). Purpose for these is unknown
|-
| 0x04
| 4 bytes
| A UNIX timestamp for when the deregistration card expires. On the WebTV smart card factory pages, this is always set to 0xffffffff to set it to not expire
|-
| 0x08
| Variable
| Deregistration code
|}

==== Example ====
The following example shows a break down of the data from an official Sony INT-W200 smart card, which uses the version 2 smart card format and is a "Go to" card. The card would have originally sent to the service a site ID of 999999, which would redirect the user to the Sony-operated site <nowiki>http://svalue.com</nowiki> (no longer run by Sony).

{| class="wikitable"
|-
! Field
! Value
|-
| Version
| "2" (0x32)
|-
| Type
| "G" (Go to)
|-
| CRC
| 0xFF (Ignore)
|-
| TLV #1 Type
| "t" (Title)
|-
| TLV #1 Length
| 0x0B
|-
| TLV #1 Value
| "Sony Value "
|-
| TLV #2 Type
| "G" (Go to)
|-
| TLV #2 Length
| 0x07
|-
| TLV #2 Value
| "i999999" (Server-side numeric ID 999999 - points to <nowiki>http://svalue.com</nowiki> on the original server)
|}

'''TODO'''

User:Wtv-411/Smart Card

2023-08-05T18:50:24Z

Wtv-411: /* Service Side */

{{WTVPNav}}

'''WIP'''

----

Smart Cards were used on the WebTV and first-generation MSN TV service to take the user to a site, set up ISP options, etc. They were rarely utilized, and were removed on the MSN TV 2.

WebTV/MSN TV boxes support smart cards that are compliant with the ISO-7816 standard. Smart cards can hold up to 122 bytes of data.

== Service Side ==
When a smart card is inserted into the WebTV/MSN TV receiver, it will show a message on the screen with the smart card name and a progress bar. In the background, the box will contact the URL from the <code>wtv-smartcard-inserted-url</code> header sent from headwaiter, which is usually <code>wtv-smartcard:/insert</code>. The box will <code>POST</code> the raw data read from the card to the URL. While official clients can supposedly send the smart card data raw, it has only been documented to send the data as a Base64 encoded string with every 4 bytes swapped:

<pre>
POST wtv-smartcard:/insert\r\n
User-Agent: Mozilla/4.0 WebTV/2.6 (compatible; MSIE 4.0)\r\n
wtv-show-time-record: 4 <wtv-home:/home?>\r\n
wtv-request-type: primary\r\n
wtv-incarnation: 14\r\n
Content-type: application/octet-stream\r\n
Content-length: 36\r\n
\r\n
/fkMTtAd552bhZFIlVHbHcEI5kTa5kTO==QO
</pre>

<code>/fkMTtAd552bhZFIlVHbHcEI5kTa5kTO==QO</code> -> <code>Mkf/dAtTb255IFZhbHVlIEcHaTk5OTk5OQ==</code>

The server will unswap the bytes, decode the data into its raw binary form, and then parse it as smart card data to determine what to do with it. While the specifics of the <code>wtv-smartcard</code> aren't well known, what is known is that the server will redirect the box to the website if the smart card data is for a "Go To" card and send an error page is the data is invalid.

In some cases, the box will send an error header (e.g: "error=-68") if something goes wrong.

== Format ==

WebTV/MSN TV smart cards use a proprietary format to store data. There are two known versions of the format that WebTV Networks developed: version 1 and version 2. The only smart card known to be produced for WebTV boxes (the Sony smart card bundled with Sony INT-W200 Internet Terminals) uses the version 2 format, though.

Thanks to internal WebTV pages from a "smart card factory" service containing JavaScript that directly handled writing in both formats, these formats have been able to be reverse engineered to varying degrees of success. This page will currently only cover the version 2 smart card format though, since that is the format we have the most information on.

=== Version 2 ===
Version 2 smart cards make use of a header and TLVs (type-length-value) to store data. A TLV performs one specific function based on the type specified and stores data in a specific way. Version 2 smart cards can have one TLV at minimum for the main card data that corresponds to the card type in the header. If the card type is not a deregistration card, the smart card can also contain an optional title TLV, which has to precede all other TLVs and contains text that will be displayed as a title in a dialog box when the smart card is inserted into the WebTV/MSN TV box. Multiple TLVs in general can be added if the card type isn't set to deregistration or if it is set as a "multi" card, which can perform several functions at once.

The general format for version 2 smart cards goes like this:

{| class="wikitable"
|-
! Offset
! Length
! Description
|-
| 0x00
| 1 byte
| Version identifier. Always <code>2</code> (0x32)
|-
| 0x01
| 1 byte
| Card type
|-
| 0x02
| 1 byte
| CRC value. This is an optional field and a value of 0xff can be specified to make WebTV/MSN TV ignore the CRC
|-
| 0x03
| Variable
| TLV data
|}

TLVs are simple structures that store data under a specified type. They can technically hold up to 256 bytes of data, and follow this format:

{| class="wikitable"
|-
! Field
! Type
! Description
|-
| Type
| uint8
| Type code
|-
| Length
| uint8
| 8-bit length of value
|-
| Value
| Byte array
| Variable length value data
|}

==== Known Card Types ====
* A - '''A'''ffinity. This feature is currently undocumented, but involves an enrollment and program code
* F - '''F'''avorites
* W - Deregistration. Only the deregstration TLV can be present in the smart card data if this type is set
* O - '''O'''penISP (Use your own ISP)
* G - '''G'''o To (a website)
* M - Multi-card. Stores multiple TLVs to run several card functions at one time

==== Known TLVs ====
TLVs will be listed by their type code.

===== "t" (Title) =====
* Description: Specifies a title to give the smart card. Optional, but has to precede all other TLVs. This TLV can '''not''' be present in deregistration smart cards
* Value: The title for the smart card

===== "A" (Affinity data) =====
* Description: Required for Affinity smart cards
* Value: A byte for the version number (either <code>1</code> for version 1 Affinity data or <code>2</code> for version 2 Affinity data), followed by the actual data.
** For version 2 Affinity data: The format is the program code, a tab character (0x09), and the enrollment code
** For version 1 Affinity data: Just the enrollment code is added

===== "G" (Go To data) =====
* Description: Data that defines a website the smart card will make the box access. The wtv-smartcard service would have taken care of redirecting the client to the specified site if it existed. Required for "Go To" smart cards
* Value: A byte for the type of website to be accessed (<code>i</code> - Server-side numeric ID that will be translated by the WebTV/MSN TV service, <code>h</code> - HTTP URL, <code>s</code> - HTTPS URL), followed by a numeric ID if the type is <code>i</code>, or the direct URL for the site without the "http(s)://" prefix.

===== "O" (OpenISP) =====
* Description: Data for setting up a predefined custom ISP to connect to WebTV/MSN TV with. Required for OpenISP smart cards
* Value: "1", followed by the ISP data separated with a tab character (0x09)

ISP information structure:
* ISP name - String
* 0x09 separator
* ISP login name - String
* 0x09 separator
* ISP password - String
* 0x09 separator
* Primary modem number - 10-digit phone number
* 0x09 separator
* Backup modem number - 10-digit phone number. Optional

===== "W" (Deregistration) =====
* Description: Data for de-registering a client. If this TLV is used, then the card type '''must''' be set to deregistration as well and no other TLVs may be added
* Value: Binary structure

Deregistration data structure:

{| class="wikitable"
|-
! Offset
! Length
! Description
|-
| 0x00
| 4 bytes
| Contains a specific sequence of bytes (in hex: <code>31 75 fa b0</code>). Purpose for these is unknown
|-
| 0x04
| 4 bytes
| A UNIX timestamp for when the deregistration card expires. On the WebTV smart card factory pages, this is always set to 0xffffffff to set it to not expire
|-
| 0x08
| Variable
| Deregistration code
|}

==== Example ====
The following example shows a break down of the data from an official Sony INT-W200 smart card, which uses the version 2 smart card format and is a "Go to" card. The card would have originally sent to the service a site ID of 999999, which would redirect the user to the Sony-operated site <nowiki>http://svalue.com</nowiki> (no longer run by Sony).

{| class="wikitable"
|-
! Field
! Value
|-
| Version
| "2" (0x32)
|-
| Type
| "G" (Go to)
|-
| CRC
| 0xFF (Ignore)
|-
| TLV #1 Type
| "t" (Title)
|-
| TLV #1 Length
| 0x0B
|-
| TLV #1 Value
| "Sony Value "
|-
| TLV #2 Type
| "G" (Go to)
|-
| TLV #2 Length
| 0x07
|-
| TLV #2 Value
| "i999999" (Server-side numeric ID 999999 - points to <nowiki>http://svalue.com</nowiki> on the original server)
|}

'''TODO'''

User:Wtv-411/Smart Card

2023-08-05T18:47:24Z

Wtv-411: Re-arrange sections

{{WTVPNav}}

'''WIP'''

----

Smart Cards were used on the WebTV and first-generation MSN TV service to take the user to a site, set up ISP options, etc. They were rarely utilized, and were removed on the MSN TV 2.

WebTV/MSN TV boxes support smart cards that are compliant with the ISO-7816 standard. Smart cards can hold up to 122 bytes of data.

== Service Side ==
When a smart card is inserted into the WebTV/MSN TV receiver, it will show a message on the screen with the smart card name and a progress bar. In the background, the box will contact the URL from the <code>wtv-smartcard-inserted-url</code> header sent from headwaiter, which is usually <code>wtv-smartcard:/insert</code>. The box will <code>POST</code> the raw data read from the card to the URL. While official clients can supposedly send the smart card data raw, it has only been documented to send the data as a Base64 encoded string with every 4 bytes swapped:

<pre>
POST wtv-smartcard:/insert\r\n
User-Agent: Mozilla/4.0 WebTV/2.6 (compatible; MSIE 4.0)\r\n
wtv-show-time-record: 4 <wtv-home:/home?>\r\n
wtv-request-type: primary\r\n
wtv-incarnation: 14\r\n
Content-type: application/octet-stream\r\n
Content-length: 36\r\n
\r\n
/fkMTtAd552bhZFIlVHbHcEI5kTa5kTO==QO
</pre>

The server will unswap the bytes, decode the data into its raw binary form, and then parse it as smart card data to determine what to do with it. While the specifics of the <code>wtv-smartcard</code> aren't well known, what is known is that the server will redirect the box to the website if the smart card data is for a "Go To" card and send an error page is the data is invalid.

In some cases, the box will send an error header (e.g: "error=-68") if something goes wrong.

== Format ==

WebTV/MSN TV smart cards use a proprietary format to store data. There are two known versions of the format that WebTV Networks developed: version 1 and version 2. The only smart card known to be produced for WebTV boxes (the Sony smart card bundled with Sony INT-W200 Internet Terminals) uses the version 2 format, though.

Thanks to internal WebTV pages from a "smart card factory" service containing JavaScript that directly handled writing in both formats, these formats have been able to be reverse engineered to varying degrees of success. This page will currently only cover the version 2 smart card format though, since that is the format we have the most information on.

=== Version 2 ===
Version 2 smart cards make use of a header and TLVs (type-length-value) to store data. A TLV performs one specific function based on the type specified and stores data in a specific way. Version 2 smart cards can have one TLV at minimum for the main card data that corresponds to the card type in the header. If the card type is not a deregistration card, the smart card can also contain an optional title TLV, which has to precede all other TLVs and contains text that will be displayed as a title in a dialog box when the smart card is inserted into the WebTV/MSN TV box. Multiple TLVs in general can be added if the card type isn't set to deregistration or if it is set as a "multi" card, which can perform several functions at once.

The general format for version 2 smart cards goes like this:

{| class="wikitable"
|-
! Offset
! Length
! Description
|-
| 0x00
| 1 byte
| Version identifier. Always <code>2</code> (0x32)
|-
| 0x01
| 1 byte
| Card type
|-
| 0x02
| 1 byte
| CRC value. This is an optional field and a value of 0xff can be specified to make WebTV/MSN TV ignore the CRC
|-
| 0x03
| Variable
| TLV data
|}

TLVs are simple structures that store data under a specified type. They can technically hold up to 256 bytes of data, and follow this format:

{| class="wikitable"
|-
! Field
! Type
! Description
|-
| Type
| uint8
| Type code
|-
| Length
| uint8
| 8-bit length of value
|-
| Value
| Byte array
| Variable length value data
|}

==== Known Card Types ====
* A - '''A'''ffinity. This feature is currently undocumented, but involves an enrollment and program code
* F - '''F'''avorites
* W - Deregistration. Only the deregstration TLV can be present in the smart card data if this type is set
* O - '''O'''penISP (Use your own ISP)
* G - '''G'''o To (a website)
* M - Multi-card. Stores multiple TLVs to run several card functions at one time

==== Known TLVs ====
TLVs will be listed by their type code.

===== "t" (Title) =====
* Description: Specifies a title to give the smart card. Optional, but has to precede all other TLVs. This TLV can '''not''' be present in deregistration smart cards
* Value: The title for the smart card

===== "A" (Affinity data) =====
* Description: Required for Affinity smart cards
* Value: A byte for the version number (either <code>1</code> for version 1 Affinity data or <code>2</code> for version 2 Affinity data), followed by the actual data.
** For version 2 Affinity data: The format is the program code, a tab character (0x09), and the enrollment code
** For version 1 Affinity data: Just the enrollment code is added

===== "G" (Go To data) =====
* Description: Data that defines a website the smart card will make the box access. The wtv-smartcard service would have taken care of redirecting the client to the specified site if it existed. Required for "Go To" smart cards
* Value: A byte for the type of website to be accessed (<code>i</code> - Server-side numeric ID that will be translated by the WebTV/MSN TV service, <code>h</code> - HTTP URL, <code>s</code> - HTTPS URL), followed by a numeric ID if the type is <code>i</code>, or the direct URL for the site without the "http(s)://" prefix.

===== "O" (OpenISP) =====
* Description: Data for setting up a predefined custom ISP to connect to WebTV/MSN TV with. Required for OpenISP smart cards
* Value: "1", followed by the ISP data separated with a tab character (0x09)

ISP information structure:
* ISP name - String
* 0x09 separator
* ISP login name - String
* 0x09 separator
* ISP password - String
* 0x09 separator
* Primary modem number - 10-digit phone number
* 0x09 separator
* Backup modem number - 10-digit phone number. Optional

===== "W" (Deregistration) =====
* Description: Data for de-registering a client. If this TLV is used, then the card type '''must''' be set to deregistration as well and no other TLVs may be added
* Value: Binary structure

Deregistration data structure:

{| class="wikitable"
|-
! Offset
! Length
! Description
|-
| 0x00
| 4 bytes
| Contains a specific sequence of bytes (in hex: <code>31 75 fa b0</code>). Purpose for these is unknown
|-
| 0x04
| 4 bytes
| A UNIX timestamp for when the deregistration card expires. On the WebTV smart card factory pages, this is always set to 0xffffffff to set it to not expire
|-
| 0x08
| Variable
| Deregistration code
|}

==== Example ====
The following example shows a break down of the data from an official Sony INT-W200 smart card, which uses the version 2 smart card format and is a "Go to" card. The card would have originally sent to the service a site ID of 999999, which would redirect the user to the Sony-operated site <nowiki>http://svalue.com</nowiki> (no longer run by Sony).

{| class="wikitable"
|-
! Field
! Value
|-
| Version
| "2" (0x32)
|-
| Type
| "G" (Go to)
|-
| CRC
| 0xFF (Ignore)
|-
| TLV #1 Type
| "t" (Title)
|-
| TLV #1 Length
| 0x0B
|-
| TLV #1 Value
| "Sony Value "
|-
| TLV #2 Type
| "G" (Go to)
|-
| TLV #2 Length
| 0x07
|-
| TLV #2 Value
| "i999999" (Server-side numeric ID 999999 - points to <nowiki>http://svalue.com</nowiki> on the original server)
|}

'''TODO'''

User:Wtv-411/Smart Card

2023-08-05T18:44:37Z

Wtv-411: /* Known TLVs */

{{WTVPNav}}

'''WIP'''

----

Smart Cards were used on the WebTV and first-generation MSN TV service to take the user to a site, set up ISP options, etc. They were rarely utilized, and were removed on the MSN TV 2.

WebTV/MSN TV boxes support smart cards that are compliant with the ISO-7816 standard. Smart cards can hold up to 122 bytes of data.

== Format ==

WebTV/MSN TV smart cards use a proprietary format to store data. There are two known versions of the format that WebTV Networks developed: version 1 and version 2. The only smart card known to be produced for WebTV boxes (the Sony smart card bundled with Sony INT-W200 Internet Terminals) uses the version 2 format, though.

Thanks to internal WebTV pages from a "smart card factory" service containing JavaScript that directly handled writing in both formats, these formats have been able to be reverse engineered to varying degrees of success. This page will currently only cover the version 2 smart card format though, since that is the format we have the most information on.

=== Version 2 ===
Version 2 smart cards make use of a header and TLVs (type-length-value) to store data. A TLV performs one specific function based on the type specified and stores data in a specific way. Version 2 smart cards can have one TLV at minimum for the main card data that corresponds to the card type in the header. If the card type is not a deregistration card, the smart card can also contain an optional title TLV, which has to precede all other TLVs and contains text that will be displayed as a title in a dialog box when the smart card is inserted into the WebTV/MSN TV box. Multiple TLVs in general can be added if the card type isn't set to deregistration or if it is set as a "multi" card, which can perform several functions at once.

The general format for version 2 smart cards goes like this:

{| class="wikitable"
|-
! Offset
! Length
! Description
|-
| 0x00
| 1 byte
| Version identifier. Always <code>2</code> (0x32)
|-
| 0x01
| 1 byte
| Card type
|-
| 0x02
| 1 byte
| CRC value. This is an optional field and a value of 0xff can be specified to make WebTV/MSN TV ignore the CRC
|-
| 0x03
| Variable
| TLV data
|}

TLVs are simple structures that store data under a specified type. They can technically hold up to 256 bytes of data, and follow this format:

{| class="wikitable"
|-
! Field
! Type
! Description
|-
| Type
| uint8
| Type code
|-
| Length
| uint8
| 8-bit length of value
|-
| Value
| Byte array
| Variable length value data
|}

==== Known Card Types ====
* A - '''A'''ffinity. This feature is currently undocumented, but involves an enrollment and program code
* F - '''F'''avorites
* W - Deregistration. Only the deregstration TLV can be present in the smart card data if this type is set
* O - '''O'''penISP (Use your own ISP)
* G - '''G'''o To (a website)
* M - Multi-card. Stores multiple TLVs to run several card functions at one time

==== Known TLVs ====
TLVs will be listed by their type code.

===== "t" (Title) =====
* Description: Specifies a title to give the smart card. Optional, but has to precede all other TLVs. This TLV can '''not''' be present in deregistration smart cards
* Value: The title for the smart card

===== "A" (Affinity data) =====
* Description: Required for Affinity smart cards
* Value: A byte for the version number (either <code>1</code> for version 1 Affinity data or <code>2</code> for version 2 Affinity data), followed by the actual data.
** For version 2 Affinity data: The format is the program code, a tab character (0x09), and the enrollment code
** For version 1 Affinity data: Just the enrollment code is added

===== "G" (Go To data) =====
* Description: Data that defines a website the smart card will make the box access. The wtv-smartcard service would have taken care of redirecting the client to the specified site if it existed. Required for "Go To" smart cards
* Value: A byte for the type of website to be accessed (<code>i</code> - Server-side numeric ID that will be translated by the WebTV/MSN TV service, <code>h</code> - HTTP URL, <code>s</code> - HTTPS URL), followed by a numeric ID if the type is <code>i</code>, or the direct URL for the site without the "http(s)://" prefix.

===== "O" (OpenISP) =====
* Description: Data for setting up a predefined custom ISP to connect to WebTV/MSN TV with. Required for OpenISP smart cards
* Value: "1", followed by the ISP data separated with a tab character (0x09)

ISP information structure:
* ISP name - String
* 0x09 separator
* ISP login name - String
* 0x09 separator
* ISP password - String
* 0x09 separator
* Primary modem number - 10-digit phone number
* 0x09 separator
* Backup modem number - 10-digit phone number. Optional

===== "W" (Deregistration) =====
* Description: Data for de-registering a client. If this TLV is used, then the card type '''must''' be set to deregistration as well and no other TLVs may be added
* Value: Binary structure

Deregistration data structure:

{| class="wikitable"
|-
! Offset
! Length
! Description
|-
| 0x00
| 4 bytes
| Contains a specific sequence of bytes (in hex: <code>31 75 fa b0</code>). Purpose for these is unknown
|-
| 0x04
| 4 bytes
| A UNIX timestamp for when the deregistration card expires. On the WebTV smart card factory pages, this is always set to 0xffffffff to set it to not expire
|-
| 0x08
| Variable
| Deregistration code
|}

==== Example ====
The following example shows a break down of the data from an official Sony INT-W200 smart card, which uses the version 2 smart card format and is a "Go to" card. The card would have originally sent to the service a site ID of 999999, which would redirect the user to the Sony-operated site <nowiki>http://svalue.com</nowiki> (no longer run by Sony).

{| class="wikitable"
|-
! Field
! Value
|-
| Version
| "2" (0x32)
|-
| Type
| "G" (Go to)
|-
| CRC
| 0xFF (Ignore)
|-
| TLV #1 Type
| "t" (Title)
|-
| TLV #1 Length
| 0x0B
|-
| TLV #1 Value
| "Sony Value "
|-
| TLV #2 Type
| "G" (Go to)
|-
| TLV #2 Length
| 0x07
|-
| TLV #2 Value
| "i999999" (Server-side numeric ID 999999 - points to <nowiki>http://svalue.com</nowiki> on the original server)
|}

'''TODO'''


== Service Side ==
When a smart card is inserted into the WebTV/MSN TV receiver, it will show a message on the screen with the smart card name and a progress bar. In the background, the box will contact the URL from the <code>wtv-smartcard-inserted-url</code> header sent from headwaiter, which is usually <code>wtv-smartcard:/insert</code>. The box will <code>POST</code> the raw data read from the card to the URL. While official clients can supposedly send the smart card data raw, it has only been documented to send the data as a Base64 encoded string with every 4 bytes swapped:

<pre>
POST wtv-smartcard:/insert\r\n
User-Agent: Mozilla/4.0 WebTV/2.6 (compatible; MSIE 4.0)\r\n
wtv-show-time-record: 4 <wtv-home:/home?>\r\n
wtv-request-type: primary\r\n
wtv-incarnation: 14\r\n
Content-type: application/octet-stream\r\n
Content-length: 36\r\n
\r\n
/fkMTtAd552bhZFIlVHbHcEI5kTa5kTO==QO
</pre>

The server will unswap the bytes, decode the data into its raw binary form, and then parse it as smart card data to determine what to do with it. While the specifics of the <code>wtv-smartcard</code> aren't well known, what is known is that the server will redirect the box to the website if the smart card data is for a "Go To" card and send an error page is the data is invalid.

In some cases, the box will send an error header (e.g: "error=-68") if something goes wrong.

User:Wtv-411/Smart Card

2023-08-05T18:44:12Z

Wtv-411: /* Known Card Types */

{{WTVPNav}}

'''WIP'''

----

Smart Cards were used on the WebTV and first-generation MSN TV service to take the user to a site, set up ISP options, etc. They were rarely utilized, and were removed on the MSN TV 2.

WebTV/MSN TV boxes support smart cards that are compliant with the ISO-7816 standard. Smart cards can hold up to 122 bytes of data.

== Format ==

WebTV/MSN TV smart cards use a proprietary format to store data. There are two known versions of the format that WebTV Networks developed: version 1 and version 2. The only smart card known to be produced for WebTV boxes (the Sony smart card bundled with Sony INT-W200 Internet Terminals) uses the version 2 format, though.

Thanks to internal WebTV pages from a "smart card factory" service containing JavaScript that directly handled writing in both formats, these formats have been able to be reverse engineered to varying degrees of success. This page will currently only cover the version 2 smart card format though, since that is the format we have the most information on.

=== Version 2 ===
Version 2 smart cards make use of a header and TLVs (type-length-value) to store data. A TLV performs one specific function based on the type specified and stores data in a specific way. Version 2 smart cards can have one TLV at minimum for the main card data that corresponds to the card type in the header. If the card type is not a deregistration card, the smart card can also contain an optional title TLV, which has to precede all other TLVs and contains text that will be displayed as a title in a dialog box when the smart card is inserted into the WebTV/MSN TV box. Multiple TLVs in general can be added if the card type isn't set to deregistration or if it is set as a "multi" card, which can perform several functions at once.

The general format for version 2 smart cards goes like this:

{| class="wikitable"
|-
! Offset
! Length
! Description
|-
| 0x00
| 1 byte
| Version identifier. Always <code>2</code> (0x32)
|-
| 0x01
| 1 byte
| Card type
|-
| 0x02
| 1 byte
| CRC value. This is an optional field and a value of 0xff can be specified to make WebTV/MSN TV ignore the CRC
|-
| 0x03
| Variable
| TLV data
|}

TLVs are simple structures that store data under a specified type. They can technically hold up to 256 bytes of data, and follow this format:

{| class="wikitable"
|-
! Field
! Type
! Description
|-
| Type
| uint8
| Type code
|-
| Length
| uint8
| 8-bit length of value
|-
| Value
| Byte array
| Variable length value data
|}

==== Known Card Types ====
* A - '''A'''ffinity. This feature is currently undocumented, but involves an enrollment and program code
* F - '''F'''avorites
* W - Deregistration. Only the deregstration TLV can be present in the smart card data if this type is set
* O - '''O'''penISP (Use your own ISP)
* G - '''G'''o To (a website)
* M - Multi-card. Stores multiple TLVs to run several card functions at one time

==== Known TLVs ====
TLVs will be listed by their type code

===== "t" (Title) =====
* Description: Specifies a title to give the smart card. Optional, but has to precede all other TLVs. This TLV can '''not''' be present in deregistration smart cards
* Value: The title for the smart card

===== "A" (Affinity data) =====
* Description: Required for Affinity smart cards
* Value: A byte for the version number (either <code>1</code> for version 1 Affinity data or <code>2</code> for version 2 Affinity data), followed by the actual data.
** For version 2 Affinity data: The format is the program code, a tab character (0x09), and the enrollment code
** For version 1 Affinity data: Just the enrollment code is added

===== "G" (Go To data) =====
* Description: Data that defines a website the smart card will make the box access. The wtv-smartcard service would have taken care of redirecting the client to the specified site if it existed. Required for "Go To" smart cards
* Value: A byte for the type of website to be accessed (<code>i</code> - Server-side numeric ID that will be translated by the WebTV/MSN TV service, <code>h</code> - HTTP URL, <code>s</code> - HTTPS URL), followed by a numeric ID if the type is <code>i</code>, or the direct URL for the site without the "http(s)://" prefix.

===== "O" (OpenISP) =====
* Description: Data for setting up a predefined custom ISP to connect to WebTV/MSN TV with. Required for OpenISP smart cards
* Value: "1", followed by the ISP data separated with a tab character (0x09)

ISP information structure:
* ISP name - String
* 0x09 separator
* ISP login name - String
* 0x09 separator
* ISP password - String
* 0x09 separator
* Primary modem number - 10-digit phone number
* 0x09 separator
* Backup modem number - 10-digit phone number. Optional

===== "W" (Deregistration) =====
* Description: Data for de-registering a client. If this TLV is used, then the card type '''must''' be set to deregistration as well and no other TLVs may be added
* Value: Binary structure

Deregistration data structure:

{| class="wikitable"
|-
! Offset
! Length
! Description
|-
| 0x00
| 4 bytes
| Contains a specific sequence of bytes (in hex: <code>31 75 fa b0</code>). Purpose for these is unknown
|-
| 0x04
| 4 bytes
| A UNIX timestamp for when the deregistration card expires. On the WebTV smart card factory pages, this is always set to 0xffffffff to set it to not expire
|-
| 0x08
| Variable
| Deregistration code
|}

==== Example ====
The following example shows a break down of the data from an official Sony INT-W200 smart card, which uses the version 2 smart card format and is a "Go to" card. The card would have originally sent to the service a site ID of 999999, which would redirect the user to the Sony-operated site <nowiki>http://svalue.com</nowiki> (no longer run by Sony).

{| class="wikitable"
|-
! Field
! Value
|-
| Version
| "2" (0x32)
|-
| Type
| "G" (Go to)
|-
| CRC
| 0xFF (Ignore)
|-
| TLV #1 Type
| "t" (Title)
|-
| TLV #1 Length
| 0x0B
|-
| TLV #1 Value
| "Sony Value "
|-
| TLV #2 Type
| "G" (Go to)
|-
| TLV #2 Length
| 0x07
|-
| TLV #2 Value
| "i999999" (Server-side numeric ID 999999 - points to <nowiki>http://svalue.com</nowiki> on the original server)
|}

'''TODO'''


== Service Side ==
When a smart card is inserted into the WebTV/MSN TV receiver, it will show a message on the screen with the smart card name and a progress bar. In the background, the box will contact the URL from the <code>wtv-smartcard-inserted-url</code> header sent from headwaiter, which is usually <code>wtv-smartcard:/insert</code>. The box will <code>POST</code> the raw data read from the card to the URL. While official clients can supposedly send the smart card data raw, it has only been documented to send the data as a Base64 encoded string with every 4 bytes swapped:

<pre>
POST wtv-smartcard:/insert\r\n
User-Agent: Mozilla/4.0 WebTV/2.6 (compatible; MSIE 4.0)\r\n
wtv-show-time-record: 4 <wtv-home:/home?>\r\n
wtv-request-type: primary\r\n
wtv-incarnation: 14\r\n
Content-type: application/octet-stream\r\n
Content-length: 36\r\n
\r\n
/fkMTtAd552bhZFIlVHbHcEI5kTa5kTO==QO
</pre>

The server will unswap the bytes, decode the data into its raw binary form, and then parse it as smart card data to determine what to do with it. While the specifics of the <code>wtv-smartcard</code> aren't well known, what is known is that the server will redirect the box to the website if the smart card data is for a "Go To" card and send an error page is the data is invalid.

In some cases, the box will send an error header (e.g: "error=-68") if something goes wrong.

User:Wtv-411/Smart Card

2023-08-05T18:42:00Z

Wtv-411: /* Known Card Types */

{{WTVPNav}}

'''WIP'''

----

Smart Cards were used on the WebTV and first-generation MSN TV service to take the user to a site, set up ISP options, etc. They were rarely utilized, and were removed on the MSN TV 2.

WebTV/MSN TV boxes support smart cards that are compliant with the ISO-7816 standard. Smart cards can hold up to 122 bytes of data.

== Format ==

WebTV/MSN TV smart cards use a proprietary format to store data. There are two known versions of the format that WebTV Networks developed: version 1 and version 2. The only smart card known to be produced for WebTV boxes (the Sony smart card bundled with Sony INT-W200 Internet Terminals) uses the version 2 format, though.

Thanks to internal WebTV pages from a "smart card factory" service containing JavaScript that directly handled writing in both formats, these formats have been able to be reverse engineered to varying degrees of success. This page will currently only cover the version 2 smart card format though, since that is the format we have the most information on.

=== Version 2 ===
Version 2 smart cards make use of a header and TLVs (type-length-value) to store data. A TLV performs one specific function based on the type specified and stores data in a specific way. Version 2 smart cards can have one TLV at minimum for the main card data that corresponds to the card type in the header. If the card type is not a deregistration card, the smart card can also contain an optional title TLV, which has to precede all other TLVs and contains text that will be displayed as a title in a dialog box when the smart card is inserted into the WebTV/MSN TV box. Multiple TLVs in general can be added if the card type isn't set to deregistration or if it is set as a "multi" card, which can perform several functions at once.

The general format for version 2 smart cards goes like this:

{| class="wikitable"
|-
! Offset
! Length
! Description
|-
| 0x00
| 1 byte
| Version identifier. Always <code>2</code> (0x32)
|-
| 0x01
| 1 byte
| Card type
|-
| 0x02
| 1 byte
| CRC value. This is an optional field and a value of 0xff can be specified to make WebTV/MSN TV ignore the CRC
|-
| 0x03
| Variable
| TLV data
|}

TLVs are simple structures that store data under a specified type. They can technically hold up to 256 bytes of data, and follow this format:

{| class="wikitable"
|-
! Field
! Type
! Description
|-
| Type
| uint8
| Type code
|-
| Length
| uint8
| 8-bit length of value
|-
| Value
| Byte array
| Variable length value data
|}

==== Known Card Types ====
* A - '''A'''ffinity. This feature is currently undocumented, but involves an enrollment and program code
* F - '''F'''avorites
* W - Deregistration. Only the deregstration TLV can be present in the smart card data if this type is set
* O - '''O'''penISP (Use your own ISP)
* G - '''G'''o To (a website)
* M - Multi-card. Stores TLVs for different card functions

==== Known TLVs ====
TLVs will be listed by their type code

===== "t" (Title) =====
* Description: Specifies a title to give the smart card. Optional, but has to precede all other TLVs. This TLV can '''not''' be present in deregistration smart cards
* Value: The title for the smart card

===== "A" (Affinity data) =====
* Description: Required for Affinity smart cards
* Value: A byte for the version number (either <code>1</code> for version 1 Affinity data or <code>2</code> for version 2 Affinity data), followed by the actual data.
** For version 2 Affinity data: The format is the program code, a tab character (0x09), and the enrollment code
** For version 1 Affinity data: Just the enrollment code is added

===== "G" (Go To data) =====
* Description: Data that defines a website the smart card will make the box access. The wtv-smartcard service would have taken care of redirecting the client to the specified site if it existed. Required for "Go To" smart cards
* Value: A byte for the type of website to be accessed (<code>i</code> - Server-side numeric ID that will be translated by the WebTV/MSN TV service, <code>h</code> - HTTP URL, <code>s</code> - HTTPS URL), followed by a numeric ID if the type is <code>i</code>, or the direct URL for the site without the "http(s)://" prefix.

===== "O" (OpenISP) =====
* Description: Data for setting up a predefined custom ISP to connect to WebTV/MSN TV with. Required for OpenISP smart cards
* Value: "1", followed by the ISP data separated with a tab character (0x09)

ISP information structure:
* ISP name - String
* 0x09 separator
* ISP login name - String
* 0x09 separator
* ISP password - String
* 0x09 separator
* Primary modem number - 10-digit phone number
* 0x09 separator
* Backup modem number - 10-digit phone number. Optional

===== "W" (Deregistration) =====
* Description: Data for de-registering a client. If this TLV is used, then the card type '''must''' be set to deregistration as well and no other TLVs may be added
* Value: Binary structure

Deregistration data structure:

{| class="wikitable"
|-
! Offset
! Length
! Description
|-
| 0x00
| 4 bytes
| Contains a specific sequence of bytes (in hex: <code>31 75 fa b0</code>). Purpose for these is unknown
|-
| 0x04
| 4 bytes
| A UNIX timestamp for when the deregistration card expires. On the WebTV smart card factory pages, this is always set to 0xffffffff to set it to not expire
|-
| 0x08
| Variable
| Deregistration code
|}

==== Example ====
The following example shows a break down of the data from an official Sony INT-W200 smart card, which uses the version 2 smart card format and is a "Go to" card. The card would have originally sent to the service a site ID of 999999, which would redirect the user to the Sony-operated site <nowiki>http://svalue.com</nowiki> (no longer run by Sony).

{| class="wikitable"
|-
! Field
! Value
|-
| Version
| "2" (0x32)
|-
| Type
| "G" (Go to)
|-
| CRC
| 0xFF (Ignore)
|-
| TLV #1 Type
| "t" (Title)
|-
| TLV #1 Length
| 0x0B
|-
| TLV #1 Value
| "Sony Value "
|-
| TLV #2 Type
| "G" (Go to)
|-
| TLV #2 Length
| 0x07
|-
| TLV #2 Value
| "i999999" (Server-side numeric ID 999999 - points to <nowiki>http://svalue.com</nowiki> on the original server)
|}

'''TODO'''


== Service Side ==
When a smart card is inserted into the WebTV/MSN TV receiver, it will show a message on the screen with the smart card name and a progress bar. In the background, the box will contact the URL from the <code>wtv-smartcard-inserted-url</code> header sent from headwaiter, which is usually <code>wtv-smartcard:/insert</code>. The box will <code>POST</code> the raw data read from the card to the URL. While official clients can supposedly send the smart card data raw, it has only been documented to send the data as a Base64 encoded string with every 4 bytes swapped:

<pre>
POST wtv-smartcard:/insert\r\n
User-Agent: Mozilla/4.0 WebTV/2.6 (compatible; MSIE 4.0)\r\n
wtv-show-time-record: 4 <wtv-home:/home?>\r\n
wtv-request-type: primary\r\n
wtv-incarnation: 14\r\n
Content-type: application/octet-stream\r\n
Content-length: 36\r\n
\r\n
/fkMTtAd552bhZFIlVHbHcEI5kTa5kTO==QO
</pre>

The server will unswap the bytes, decode the data into its raw binary form, and then parse it as smart card data to determine what to do with it. While the specifics of the <code>wtv-smartcard</code> aren't well known, what is known is that the server will redirect the box to the website if the smart card data is for a "Go To" card and send an error page is the data is invalid.

In some cases, the box will send an error header (e.g: "error=-68") if something goes wrong.

User:Wtv-411/Smart Card

2023-08-05T18:40:51Z

Wtv-411: /* Version 2 */

{{WTVPNav}}

'''WIP'''

----

Smart Cards were used on the WebTV and first-generation MSN TV service to take the user to a site, set up ISP options, etc. They were rarely utilized, and were removed on the MSN TV 2.

WebTV/MSN TV boxes support smart cards that are compliant with the ISO-7816 standard. Smart cards can hold up to 122 bytes of data.

== Format ==

WebTV/MSN TV smart cards use a proprietary format to store data. There are two known versions of the format that WebTV Networks developed: version 1 and version 2. The only smart card known to be produced for WebTV boxes (the Sony smart card bundled with Sony INT-W200 Internet Terminals) uses the version 2 format, though.

Thanks to internal WebTV pages from a "smart card factory" service containing JavaScript that directly handled writing in both formats, these formats have been able to be reverse engineered to varying degrees of success. This page will currently only cover the version 2 smart card format though, since that is the format we have the most information on.

=== Version 2 ===
Version 2 smart cards make use of a header and TLVs (type-length-value) to store data. A TLV performs one specific function based on the type specified and stores data in a specific way. Version 2 smart cards can have one TLV at minimum for the main card data that corresponds to the card type in the header. If the card type is not a deregistration card, the smart card can also contain an optional title TLV, which has to precede all other TLVs and contains text that will be displayed as a title in a dialog box when the smart card is inserted into the WebTV/MSN TV box. Multiple TLVs in general can be added if the card type isn't set to deregistration or if it is set as a "multi" card, which can perform several functions at once.

The general format for version 2 smart cards goes like this:

{| class="wikitable"
|-
! Offset
! Length
! Description
|-
| 0x00
| 1 byte
| Version identifier. Always <code>2</code> (0x32)
|-
| 0x01
| 1 byte
| Card type
|-
| 0x02
| 1 byte
| CRC value. This is an optional field and a value of 0xff can be specified to make WebTV/MSN TV ignore the CRC
|-
| 0x03
| Variable
| TLV data
|}

TLVs are simple structures that store data under a specified type. They can technically hold up to 256 bytes of data, and follow this format:

{| class="wikitable"
|-
! Field
! Type
! Description
|-
| Type
| uint8
| Type code
|-
| Length
| uint8
| 8-bit length of value
|-
| Value
| Byte array
| Variable length value data
|}

==== Known Card Types ====
* A - '''A'''ffinity. This feature is currently undocumented, but involves an enrollment and program code
* F - '''F'''avorites
* W - Deregistration. Only the deregstration TLV can be present in the smart card data if this type is set
* O - '''O'''penISP (Use your own ISP)
* G - '''G'''o To (a website)
* M - Multi-card. Stores TLVs for different card types

==== Known TLVs ====
TLVs will be listed by their type code

===== "t" (Title) =====
* Description: Specifies a title to give the smart card. Optional, but has to precede all other TLVs. This TLV can '''not''' be present in deregistration smart cards
* Value: The title for the smart card

===== "A" (Affinity data) =====
* Description: Required for Affinity smart cards
* Value: A byte for the version number (either <code>1</code> for version 1 Affinity data or <code>2</code> for version 2 Affinity data), followed by the actual data.
** For version 2 Affinity data: The format is the program code, a tab character (0x09), and the enrollment code
** For version 1 Affinity data: Just the enrollment code is added

===== "G" (Go To data) =====
* Description: Data that defines a website the smart card will make the box access. The wtv-smartcard service would have taken care of redirecting the client to the specified site if it existed. Required for "Go To" smart cards
* Value: A byte for the type of website to be accessed (<code>i</code> - Server-side numeric ID that will be translated by the WebTV/MSN TV service, <code>h</code> - HTTP URL, <code>s</code> - HTTPS URL), followed by a numeric ID if the type is <code>i</code>, or the direct URL for the site without the "http(s)://" prefix.

===== "O" (OpenISP) =====
* Description: Data for setting up a predefined custom ISP to connect to WebTV/MSN TV with. Required for OpenISP smart cards
* Value: "1", followed by the ISP data separated with a tab character (0x09)

ISP information structure:
* ISP name - String
* 0x09 separator
* ISP login name - String
* 0x09 separator
* ISP password - String
* 0x09 separator
* Primary modem number - 10-digit phone number
* 0x09 separator
* Backup modem number - 10-digit phone number. Optional

===== "W" (Deregistration) =====
* Description: Data for de-registering a client. If this TLV is used, then the card type '''must''' be set to deregistration as well and no other TLVs may be added
* Value: Binary structure

Deregistration data structure:

{| class="wikitable"
|-
! Offset
! Length
! Description
|-
| 0x00
| 4 bytes
| Contains a specific sequence of bytes (in hex: <code>31 75 fa b0</code>). Purpose for these is unknown
|-
| 0x04
| 4 bytes
| A UNIX timestamp for when the deregistration card expires. On the WebTV smart card factory pages, this is always set to 0xffffffff to set it to not expire
|-
| 0x08
| Variable
| Deregistration code
|}

==== Example ====
The following example shows a break down of the data from an official Sony INT-W200 smart card, which uses the version 2 smart card format and is a "Go to" card. The card would have originally sent to the service a site ID of 999999, which would redirect the user to the Sony-operated site <nowiki>http://svalue.com</nowiki> (no longer run by Sony).

{| class="wikitable"
|-
! Field
! Value
|-
| Version
| "2" (0x32)
|-
| Type
| "G" (Go to)
|-
| CRC
| 0xFF (Ignore)
|-
| TLV #1 Type
| "t" (Title)
|-
| TLV #1 Length
| 0x0B
|-
| TLV #1 Value
| "Sony Value "
|-
| TLV #2 Type
| "G" (Go to)
|-
| TLV #2 Length
| 0x07
|-
| TLV #2 Value
| "i999999" (Server-side numeric ID 999999 - points to <nowiki>http://svalue.com</nowiki> on the original server)
|}

'''TODO'''


== Service Side ==
When a smart card is inserted into the WebTV/MSN TV receiver, it will show a message on the screen with the smart card name and a progress bar. In the background, the box will contact the URL from the <code>wtv-smartcard-inserted-url</code> header sent from headwaiter, which is usually <code>wtv-smartcard:/insert</code>. The box will <code>POST</code> the raw data read from the card to the URL. While official clients can supposedly send the smart card data raw, it has only been documented to send the data as a Base64 encoded string with every 4 bytes swapped:

<pre>
POST wtv-smartcard:/insert\r\n
User-Agent: Mozilla/4.0 WebTV/2.6 (compatible; MSIE 4.0)\r\n
wtv-show-time-record: 4 <wtv-home:/home?>\r\n
wtv-request-type: primary\r\n
wtv-incarnation: 14\r\n
Content-type: application/octet-stream\r\n
Content-length: 36\r\n
\r\n
/fkMTtAd552bhZFIlVHbHcEI5kTa5kTO==QO
</pre>

The server will unswap the bytes, decode the data into its raw binary form, and then parse it as smart card data to determine what to do with it. While the specifics of the <code>wtv-smartcard</code> aren't well known, what is known is that the server will redirect the box to the website if the smart card data is for a "Go To" card and send an error page is the data is invalid.

In some cases, the box will send an error header (e.g: "error=-68") if something goes wrong.

User:Wtv-411/Smart Card

2023-08-05T18:39:57Z

Wtv-411: /* Version 2 */

{{WTVPNav}}

'''WIP'''

----

Smart Cards were used on the WebTV and first-generation MSN TV service to take the user to a site, set up ISP options, etc. They were rarely utilized, and were removed on the MSN TV 2.

WebTV/MSN TV boxes support smart cards that are compliant with the ISO-7816 standard. Smart cards can hold up to 122 bytes of data.

== Format ==

WebTV/MSN TV smart cards use a proprietary format to store data. There are two known versions of the format that WebTV Networks developed: version 1 and version 2. The only smart card known to be produced for WebTV boxes (the Sony smart card bundled with Sony INT-W200 Internet Terminals) uses the version 2 format, though.

Thanks to internal WebTV pages from a "smart card factory" service containing JavaScript that directly handled writing in both formats, these formats have been able to be reverse engineered to varying degrees of success. This page will currently only cover the version 2 smart card format though, since that is the format we have the most information on.

=== Version 2 ===
Version 2 smart cards make use of a header and TLVs (type-length-value) to store data. A TLV performs one specific function based on the type specified and stores data in a specific way. Version 2 smart cards can have one TLV at minimum for the main card data that corresponds to the card type in the header. If the card type is not a deregistration card, the smart card can also contain an optional title TLV, which has to precede all other TLVs and contains text that will be displayed as a title in a dialog box when the smart card is inserted into the WebTV/MSN TV box. Multiple TLVs in general can be added if the card type isn't set to deregistration or if it is set as a "multi" card, which can perform several functions at once.

The general format for version 2 smart cards goes like this:

{| class="wikitable"
|-
! Offset
! Length
! Description
|-
| 0x00
| 1 byte
| Version identifier. Always <code>2</code> (0x32)
|-
| 0x01
| 1 byte
| Card type
|-
| 0x02
| 1 byte
| CRC value. This is an optional field and a value of 0xff can be specified to make WebTV/MSN TV ignore the CRC
|-
| 0x03
| Variable
| TLV data
|}

TLVs are simple structures that store data under certain types. They can technically hold up to 256 bytes of data, and follow this format:

{| class="wikitable"
|-
! Field
! Type
! Description
|-
| Type
| uint8
| Type code
|-
| Length
| uint8
| 8-bit length of value
|-
| Value
| Byte array
| Variable length value data
|}

==== Known Card Types ====
* A - '''A'''ffinity. This feature is currently undocumented, but involves an enrollment and program code
* F - '''F'''avorites
* W - Deregistration. Only the deregstration TLV can be present in the smart card data if this type is set
* O - '''O'''penISP (Use your own ISP)
* G - '''G'''o To (a website)
* M - Multi-card. Stores TLVs for different card types

==== Known TLVs ====
TLVs will be listed by their type code

===== "t" (Title) =====
* Description: Specifies a title to give the smart card. Optional, but has to precede all other TLVs. This TLV can '''not''' be present in deregistration smart cards
* Value: The title for the smart card

===== "A" (Affinity data) =====
* Description: Required for Affinity smart cards
* Value: A byte for the version number (either <code>1</code> for version 1 Affinity data or <code>2</code> for version 2 Affinity data), followed by the actual data.
** For version 2 Affinity data: The format is the program code, a tab character (0x09), and the enrollment code
** For version 1 Affinity data: Just the enrollment code is added

===== "G" (Go To data) =====
* Description: Data that defines a website the smart card will make the box access. The wtv-smartcard service would have taken care of redirecting the client to the specified site if it existed. Required for "Go To" smart cards
* Value: A byte for the type of website to be accessed (<code>i</code> - Server-side numeric ID that will be translated by the WebTV/MSN TV service, <code>h</code> - HTTP URL, <code>s</code> - HTTPS URL), followed by a numeric ID if the type is <code>i</code>, or the direct URL for the site without the "http(s)://" prefix.

===== "O" (OpenISP) =====
* Description: Data for setting up a predefined custom ISP to connect to WebTV/MSN TV with. Required for OpenISP smart cards
* Value: "1", followed by the ISP data separated with a tab character (0x09)

ISP information structure:
* ISP name - String
* 0x09 separator
* ISP login name - String
* 0x09 separator
* ISP password - String
* 0x09 separator
* Primary modem number - 10-digit phone number
* 0x09 separator
* Backup modem number - 10-digit phone number. Optional

===== "W" (Deregistration) =====
* Description: Data for de-registering a client. If this TLV is used, then the card type '''must''' be set to deregistration as well and no other TLVs may be added
* Value: Binary structure

Deregistration data structure:

{| class="wikitable"
|-
! Offset
! Length
! Description
|-
| 0x00
| 4 bytes
| Contains a specific sequence of bytes (in hex: <code>31 75 fa b0</code>). Purpose for these is unknown
|-
| 0x04
| 4 bytes
| A UNIX timestamp for when the deregistration card expires. On the WebTV smart card factory pages, this is always set to 0xffffffff to set it to not expire
|-
| 0x08
| Variable
| Deregistration code
|}

==== Example ====
The following example shows a break down of the data from an official Sony INT-W200 smart card, which uses the version 2 smart card format and is a "Go to" card. The card would have originally sent to the service a site ID of 999999, which would redirect the user to the Sony-operated site <nowiki>http://svalue.com</nowiki> (no longer run by Sony).

{| class="wikitable"
|-
! Field
! Value
|-
| Version
| "2" (0x32)
|-
| Type
| "G" (Go to)
|-
| CRC
| 0xFF (Ignore)
|-
| TLV #1 Type
| "t" (Title)
|-
| TLV #1 Length
| 0x0B
|-
| TLV #1 Value
| "Sony Value "
|-
| TLV #2 Type
| "G" (Go to)
|-
| TLV #2 Length
| 0x07
|-
| TLV #2 Value
| "i999999" (Server-side numeric ID 999999 - points to <nowiki>http://svalue.com</nowiki> on the original server)
|}

'''TODO'''


== Service Side ==
When a smart card is inserted into the WebTV/MSN TV receiver, it will show a message on the screen with the smart card name and a progress bar. In the background, the box will contact the URL from the <code>wtv-smartcard-inserted-url</code> header sent from headwaiter, which is usually <code>wtv-smartcard:/insert</code>. The box will <code>POST</code> the raw data read from the card to the URL. While official clients can supposedly send the smart card data raw, it has only been documented to send the data as a Base64 encoded string with every 4 bytes swapped:

<pre>
POST wtv-smartcard:/insert\r\n
User-Agent: Mozilla/4.0 WebTV/2.6 (compatible; MSIE 4.0)\r\n
wtv-show-time-record: 4 <wtv-home:/home?>\r\n
wtv-request-type: primary\r\n
wtv-incarnation: 14\r\n
Content-type: application/octet-stream\r\n
Content-length: 36\r\n
\r\n
/fkMTtAd552bhZFIlVHbHcEI5kTa5kTO==QO
</pre>

The server will unswap the bytes, decode the data into its raw binary form, and then parse it as smart card data to determine what to do with it. While the specifics of the <code>wtv-smartcard</code> aren't well known, what is known is that the server will redirect the box to the website if the smart card data is for a "Go To" card and send an error page is the data is invalid.

In some cases, the box will send an error header (e.g: "error=-68") if something goes wrong.

User:Wtv-411/Smart Card

2023-08-05T18:32:57Z

Wtv-411: /* Example */ Remove links from svalue.com

{{WTVPNav}}

'''WIP'''

----

Smart Cards were used on the WebTV and first-generation MSN TV service to take the user to a site, set up ISP options, etc. They were rarely utilized, and were removed on the MSN TV 2.

WebTV/MSN TV boxes support smart cards that are compliant with the ISO-7816 standard. Smart cards can hold up to 122 bytes of data.

== Format ==

WebTV/MSN TV smart cards use a proprietary format to store data. There are two known versions of the format that WebTV Networks developed: version 1 and version 2. The only smart card known to be produced for WebTV boxes (the Sony smart card bundled with Sony INT-W200 Internet Terminals) uses the version 2 format, though.

Thanks to internal WebTV pages from a "smart card factory" service containing JavaScript that directly handled writing in both formats, these formats have been able to be reverse engineered to varying degrees of success. This page will currently only cover the version 2 smart card format though, since that is the format we have the most information on.

=== Version 2 ===
Version 2 smart cards make use of a header and TLVs (type-length-value) to store data. A TLV performs one specific function based on the type specified and stores data in a specific way. Version 2 smart card data can have one TLV at minimum for the main card data that corresponds to the card type in the header. If the card type is not a deregistration card, the smart card can also contain an optional title TLV, which has to precede all other TLVs and contains text for a title that will be displayed when the smart card is inserted into the box. Multiple TLVs in general can be added if the card type isn't set to deregistration or if it is set as a "multi" card, which can perform several functions at once.

The general format for version 2 smart cards goes like this:

{| class="wikitable"
|-
! Offset
! Length
! Description
|-
| 0x00
| 1 byte
| Version identifier. Always <code>2</code> (0x32)
|-
| 0x01
| 1 byte
| Card type
|-
| 0x02
| 1 byte
| CRC value. This is an optional field and a value of 0xff can be specified to make WebTV/MSN TV ignore the CRC
|-
| 0x03
| Variable
| TLV data
|}

TLVs are simple structures that store data under certain types. They can technically hold up to 256 bytes of data, and follow this format:

{| class="wikitable"
|-
! Field
! Type
! Description
|-
| Type
| uint8
| Type code
|-
| Length
| uint8
| 8-bit length of value
|-
| Value
| Byte array
| Variable length value data
|}

==== Known Card Types ====
* A - '''A'''ffinity. This feature is currently undocumented, but involves an enrollment and program code
* F - '''F'''avorites
* W - Deregistration. Only the deregstration TLV can be present in the smart card data if this type is set
* O - '''O'''penISP (Use your own ISP)
* G - '''G'''o To (a website)
* M - Multi-card. Stores TLVs for different card types

==== Known TLVs ====
TLVs will be listed by their type code

===== "t" (Title) =====
* Description: Specifies a title to give the smart card. Optional, but has to precede all other TLVs. This TLV can '''not''' be present in deregistration smart cards
* Value: The title for the smart card

===== "A" (Affinity data) =====
* Description: Required for Affinity smart cards
* Value: A byte for the version number (either <code>1</code> for version 1 Affinity data or <code>2</code> for version 2 Affinity data), followed by the actual data.
** For version 2 Affinity data: The format is the program code, a tab character (0x09), and the enrollment code
** For version 1 Affinity data: Just the enrollment code is added

===== "G" (Go To data) =====
* Description: Data that defines a website the smart card will make the box access. The wtv-smartcard service would have taken care of redirecting the client to the specified site if it existed. Required for "Go To" smart cards
* Value: A byte for the type of website to be accessed (<code>i</code> - Server-side numeric ID that will be translated by the WebTV/MSN TV service, <code>h</code> - HTTP URL, <code>s</code> - HTTPS URL), followed by a numeric ID if the type is <code>i</code>, or the direct URL for the site without the "http(s)://" prefix.

===== "O" (OpenISP) =====
* Description: Data for setting up a predefined custom ISP to connect to WebTV/MSN TV with. Required for OpenISP smart cards
* Value: "1", followed by the ISP data separated with a tab character (0x09)

ISP information structure:
* ISP name - String
* 0x09 separator
* ISP login name - String
* 0x09 separator
* ISP password - String
* 0x09 separator
* Primary modem number - 10-digit phone number
* 0x09 separator
* Backup modem number - 10-digit phone number. Optional

===== "W" (Deregistration) =====
* Description: Data for de-registering a client. If this TLV is used, then the card type '''must''' be set to deregistration as well and no other TLVs may be added
* Value: Binary structure

Deregistration data structure:

{| class="wikitable"
|-
! Offset
! Length
! Description
|-
| 0x00
| 4 bytes
| Contains a specific sequence of bytes (in hex: <code>31 75 fa b0</code>). Purpose for these is unknown
|-
| 0x04
| 4 bytes
| A UNIX timestamp for when the deregistration card expires. On the WebTV smart card factory pages, this is always set to 0xffffffff to set it to not expire
|-
| 0x08
| Variable
| Deregistration code
|}

==== Example ====
The following example shows a break down of the data from an official Sony INT-W200 smart card, which uses the version 2 smart card format and is a "Go to" card. The card would have originally sent to the service a site ID of 999999, which would redirect the user to the Sony-operated site <nowiki>http://svalue.com</nowiki> (no longer run by Sony).

{| class="wikitable"
|-
! Field
! Value
|-
| Version
| "2" (0x32)
|-
| Type
| "G" (Go to)
|-
| CRC
| 0xFF (Ignore)
|-
| TLV #1 Type
| "t" (Title)
|-
| TLV #1 Length
| 0x0B
|-
| TLV #1 Value
| "Sony Value "
|-
| TLV #2 Type
| "G" (Go to)
|-
| TLV #2 Length
| 0x07
|-
| TLV #2 Value
| "i999999" (Server-side numeric ID 999999 - points to <nowiki>http://svalue.com</nowiki> on the original server)
|}

'''TODO'''


== Service Side ==
When a smart card is inserted into the WebTV/MSN TV receiver, it will show a message on the screen with the smart card name and a progress bar. In the background, the box will contact the URL from the <code>wtv-smartcard-inserted-url</code> header sent from headwaiter, which is usually <code>wtv-smartcard:/insert</code>. The box will <code>POST</code> the raw data read from the card to the URL. While official clients can supposedly send the smart card data raw, it has only been documented to send the data as a Base64 encoded string with every 4 bytes swapped:

<pre>
POST wtv-smartcard:/insert\r\n
User-Agent: Mozilla/4.0 WebTV/2.6 (compatible; MSIE 4.0)\r\n
wtv-show-time-record: 4 <wtv-home:/home?>\r\n
wtv-request-type: primary\r\n
wtv-incarnation: 14\r\n
Content-type: application/octet-stream\r\n
Content-length: 36\r\n
\r\n
/fkMTtAd552bhZFIlVHbHcEI5kTa5kTO==QO
</pre>

The server will unswap the bytes, decode the data into its raw binary form, and then parse it as smart card data to determine what to do with it. While the specifics of the <code>wtv-smartcard</code> aren't well known, what is known is that the server will redirect the box to the website if the smart card data is for a "Go To" card and send an error page is the data is invalid.

In some cases, the box will send an error header (e.g: "error=-68") if something goes wrong.

User:Wtv-411/Smart Card

2023-08-05T18:32:16Z

Wtv-411: /* Version 2 */

{{WTVPNav}}

'''WIP'''

----

Smart Cards were used on the WebTV and first-generation MSN TV service to take the user to a site, set up ISP options, etc. They were rarely utilized, and were removed on the MSN TV 2.

WebTV/MSN TV boxes support smart cards that are compliant with the ISO-7816 standard. Smart cards can hold up to 122 bytes of data.

== Format ==

WebTV/MSN TV smart cards use a proprietary format to store data. There are two known versions of the format that WebTV Networks developed: version 1 and version 2. The only smart card known to be produced for WebTV boxes (the Sony smart card bundled with Sony INT-W200 Internet Terminals) uses the version 2 format, though.

Thanks to internal WebTV pages from a "smart card factory" service containing JavaScript that directly handled writing in both formats, these formats have been able to be reverse engineered to varying degrees of success. This page will currently only cover the version 2 smart card format though, since that is the format we have the most information on.

=== Version 2 ===
Version 2 smart cards make use of a header and TLVs (type-length-value) to store data. A TLV performs one specific function based on the type specified and stores data in a specific way. Version 2 smart card data can have one TLV at minimum for the main card data that corresponds to the card type in the header. If the card type is not a deregistration card, the smart card can also contain an optional title TLV, which has to precede all other TLVs and contains text for a title that will be displayed when the smart card is inserted into the box. Multiple TLVs in general can be added if the card type isn't set to deregistration or if it is set as a "multi" card, which can perform several functions at once.

The general format for version 2 smart cards goes like this:

{| class="wikitable"
|-
! Offset
! Length
! Description
|-
| 0x00
| 1 byte
| Version identifier. Always <code>2</code> (0x32)
|-
| 0x01
| 1 byte
| Card type
|-
| 0x02
| 1 byte
| CRC value. This is an optional field and a value of 0xff can be specified to make WebTV/MSN TV ignore the CRC
|-
| 0x03
| Variable
| TLV data
|}

TLVs are simple structures that store data under certain types. They can technically hold up to 256 bytes of data, and follow this format:

{| class="wikitable"
|-
! Field
! Type
! Description
|-
| Type
| uint8
| Type code
|-
| Length
| uint8
| 8-bit length of value
|-
| Value
| Byte array
| Variable length value data
|}

==== Known Card Types ====
* A - '''A'''ffinity. This feature is currently undocumented, but involves an enrollment and program code
* F - '''F'''avorites
* W - Deregistration. Only the deregstration TLV can be present in the smart card data if this type is set
* O - '''O'''penISP (Use your own ISP)
* G - '''G'''o To (a website)
* M - Multi-card. Stores TLVs for different card types

==== Known TLVs ====
TLVs will be listed by their type code

===== "t" (Title) =====
* Description: Specifies a title to give the smart card. Optional, but has to precede all other TLVs. This TLV can '''not''' be present in deregistration smart cards
* Value: The title for the smart card

===== "A" (Affinity data) =====
* Description: Required for Affinity smart cards
* Value: A byte for the version number (either <code>1</code> for version 1 Affinity data or <code>2</code> for version 2 Affinity data), followed by the actual data.
** For version 2 Affinity data: The format is the program code, a tab character (0x09), and the enrollment code
** For version 1 Affinity data: Just the enrollment code is added

===== "G" (Go To data) =====
* Description: Data that defines a website the smart card will make the box access. The wtv-smartcard service would have taken care of redirecting the client to the specified site if it existed. Required for "Go To" smart cards
* Value: A byte for the type of website to be accessed (<code>i</code> - Server-side numeric ID that will be translated by the WebTV/MSN TV service, <code>h</code> - HTTP URL, <code>s</code> - HTTPS URL), followed by a numeric ID if the type is <code>i</code>, or the direct URL for the site without the "http(s)://" prefix.

===== "O" (OpenISP) =====
* Description: Data for setting up a predefined custom ISP to connect to WebTV/MSN TV with. Required for OpenISP smart cards
* Value: "1", followed by the ISP data separated with a tab character (0x09)

ISP information structure:
* ISP name - String
* 0x09 separator
* ISP login name - String
* 0x09 separator
* ISP password - String
* 0x09 separator
* Primary modem number - 10-digit phone number
* 0x09 separator
* Backup modem number - 10-digit phone number. Optional

===== "W" (Deregistration) =====
* Description: Data for de-registering a client. If this TLV is used, then the card type '''must''' be set to deregistration as well and no other TLVs may be added
* Value: Binary structure

Deregistration data structure:

{| class="wikitable"
|-
! Offset
! Length
! Description
|-
| 0x00
| 4 bytes
| Contains a specific sequence of bytes (in hex: <code>31 75 fa b0</code>). Purpose for these is unknown
|-
| 0x04
| 4 bytes
| A UNIX timestamp for when the deregistration card expires. On the WebTV smart card factory pages, this is always set to 0xffffffff to set it to not expire
|-
| 0x08
| Variable
| Deregistration code
|}

==== Example ====
The following example shows a break down of the data from an official Sony INT-W200 smart card, which uses the version 2 smart card format and is a "Go to" card. The card would have originally sent to the service a site ID of 999999, which would redirect the user to the Sony-operated site <code>http://svalue.com</code> (no longer run by Sony).

{| class="wikitable"
|-
! Field
! Value
|-
| Version
| "2" (0x32)
|-
| Type
| "G" (Go to)
|-
| CRC
| 0xFF (Ignore)
|-
| TLV #1 Type
| "t" (Title)
|-
| TLV #1 Length
| 0x0B
|-
| TLV #1 Value
| "Sony Value "
|-
| TLV #2 Type
| "G" (Go to)
|-
| TLV #2 Length
| 0x07
|-
| TLV #2 Value
| "i999999" (Server-side numeric ID 999999 - points to http://svalue.com on the original server)
|}

'''TODO'''


== Service Side ==
When a smart card is inserted into the WebTV/MSN TV receiver, it will show a message on the screen with the smart card name and a progress bar. In the background, the box will contact the URL from the <code>wtv-smartcard-inserted-url</code> header sent from headwaiter, which is usually <code>wtv-smartcard:/insert</code>. The box will <code>POST</code> the raw data read from the card to the URL. While official clients can supposedly send the smart card data raw, it has only been documented to send the data as a Base64 encoded string with every 4 bytes swapped:

<pre>
POST wtv-smartcard:/insert\r\n
User-Agent: Mozilla/4.0 WebTV/2.6 (compatible; MSIE 4.0)\r\n
wtv-show-time-record: 4 <wtv-home:/home?>\r\n
wtv-request-type: primary\r\n
wtv-incarnation: 14\r\n
Content-type: application/octet-stream\r\n
Content-length: 36\r\n
\r\n
/fkMTtAd552bhZFIlVHbHcEI5kTa5kTO==QO
</pre>

The server will unswap the bytes, decode the data into its raw binary form, and then parse it as smart card data to determine what to do with it. While the specifics of the <code>wtv-smartcard</code> aren't well known, what is known is that the server will redirect the box to the website if the smart card data is for a "Go To" card and send an error page is the data is invalid.

In some cases, the box will send an error header (e.g: "error=-68") if something goes wrong.

User:Wtv-411/Smart Card

2023-08-05T18:28:07Z

Wtv-411: /* Known TLVs */

{{WTVPNav}}

'''WIP'''

----

Smart Cards were used on the WebTV and first-generation MSN TV service to take the user to a site, set up ISP options, etc. They were rarely utilized, and were removed on the MSN TV 2.

WebTV/MSN TV boxes support smart cards that are compliant with the ISO-7816 standard. Smart cards can hold up to 122 bytes of data.

== Format ==

WebTV/MSN TV smart cards use a proprietary format to store data. There are two known versions of the format that WebTV Networks developed: version 1 and version 2. The only smart card known to be produced for WebTV boxes (the Sony smart card bundled with Sony INT-W200 Internet Terminals) uses the version 2 format, though.

Thanks to internal WebTV pages from a "smart card factory" service containing JavaScript that directly handled writing in both formats, these formats have been able to be reverse engineered to varying degrees of success. This page will currently only cover the version 2 smart card format though, since that is the format we have the most information on.

=== Version 2 ===
Version 2 smart cards make use of a header and TLVs (type-length-value) to store data. Version 2 smart card data can have one TLV at minimum for the main card data that corresponds to the card type in the header. If the card type is not a deregistration card, the data can also contain an optional title TLV, which has to precede all other TLVs and contains text for a title that will be displayed when the smart card is inserted into the box. Multiple TLVs in general can be added if the card type isn't deregistration or if it is set to be a "multi" card.

{| class="wikitable"
|-
! Offset
! Length
! Description
|-
| 0x00
| 1 byte
| Version identifier. Always <code>2</code> (0x32)
|-
| 0x01
| 1 byte
| Card type
|-
| 0x02
| 1 byte
| CRC value. This is an optional field and a value of 0xff can be specified to make WebTV/MSN TV ignore the CRC
|-
| 0x03
| Variable
| TLV data
|}

TLVs are simple structures that store data under certain types. They can technically hold up to 256 bytes of data, and follow this format:

{| class="wikitable"
|-
! Field
! Type
! Description
|-
| Type
| uint8
| Type code
|-
| Length
| uint8
| 8-bit length of value
|-
| Value
| Byte array
| Variable length value data
|}

==== Known Card Types ====
* A - '''A'''ffinity. This feature is currently undocumented, but involves an enrollment and program code
* F - '''F'''avorites
* W - Deregistration. Only the deregstration TLV can be present in the smart card data if this type is set
* O - '''O'''penISP (Use your own ISP)
* G - '''G'''o To (a website)
* M - Multi-card. Stores TLVs for different card types

==== Known TLVs ====
TLVs will be listed by their type code

===== "t" (Title) =====
* Description: Specifies a title to give the smart card. Optional, but has to precede all other TLVs. This TLV can '''not''' be present in deregistration smart cards
* Value: The title for the smart card

===== "A" (Affinity data) =====
* Description: Required for Affinity smart cards
* Value: A byte for the version number (either <code>1</code> for version 1 Affinity data or <code>2</code> for version 2 Affinity data), followed by the actual data.
** For version 2 Affinity data: The format is the program code, a tab character (0x09), and the enrollment code
** For version 1 Affinity data: Just the enrollment code is added

===== "G" (Go To data) =====
* Description: Data that defines a website the smart card will make the box access. The wtv-smartcard service would have taken care of redirecting the client to the specified site if it existed. Required for "Go To" smart cards
* Value: A byte for the type of website to be accessed (<code>i</code> - Server-side numeric ID that will be translated by the WebTV/MSN TV service, <code>h</code> - HTTP URL, <code>s</code> - HTTPS URL), followed by a numeric ID if the type is <code>i</code>, or the direct URL for the site without the "http(s)://" prefix.

===== "O" (OpenISP) =====
* Description: Data for setting up a predefined custom ISP to connect to WebTV/MSN TV with. Required for OpenISP smart cards
* Value: "1", followed by the ISP data separated with a tab character (0x09)

ISP information structure:
* ISP name - String
* 0x09 separator
* ISP login name - String
* 0x09 separator
* ISP password - String
* 0x09 separator
* Primary modem number - 10-digit phone number
* 0x09 separator
* Backup modem number - 10-digit phone number. Optional

===== "W" (Deregistration) =====
* Description: Data for de-registering a client. If this TLV is used, then the card type '''must''' be set to deregistration as well and no other TLVs may be added
* Value: Binary structure

Deregistration data structure:

{| class="wikitable"
|-
! Offset
! Length
! Description
|-
| 0x00
| 4 bytes
| Contains a specific sequence of bytes (in hex: <code>31 75 fa b0</code>). Purpose for these is unknown
|-
| 0x04
| 4 bytes
| A UNIX timestamp for when the deregistration card expires. On the WebTV smart card factory pages, this is always set to 0xffffffff to set it to not expire
|-
| 0x08
| Variable
| Deregistration code
|}

==== Example ====
The following example shows a break down of the data from an official Sony INT-W200 smart card, which uses the version 2 smart card format and is a "Go to" card. The card would have originally sent to the service a site ID of 999999, which would redirect the user to the Sony-operated site <code>http://svalue.com</code> (no longer run by Sony).

{| class="wikitable"
|-
! Field
! Value
|-
| Version
| "2" (0x32)
|-
| Type
| "G" (Go to)
|-
| CRC
| 0xFF (Ignore)
|-
| TLV #1 Type
| "t" (Title)
|-
| TLV #1 Length
| 0x0B
|-
| TLV #1 Value
| "Sony Value "
|-
| TLV #2 Type
| "G" (Go to)
|-
| TLV #2 Length
| 0x07
|-
| TLV #2 Value
| "i999999" (Server-side numeric ID 999999 - points to http://svalue.com on the original server)
|}

'''TODO'''


== Service Side ==
When a smart card is inserted into the WebTV/MSN TV receiver, it will show a message on the screen with the smart card name and a progress bar. In the background, the box will contact the URL from the <code>wtv-smartcard-inserted-url</code> header sent from headwaiter, which is usually <code>wtv-smartcard:/insert</code>. The box will <code>POST</code> the raw data read from the card to the URL. While official clients can supposedly send the smart card data raw, it has only been documented to send the data as a Base64 encoded string with every 4 bytes swapped:

<pre>
POST wtv-smartcard:/insert\r\n
User-Agent: Mozilla/4.0 WebTV/2.6 (compatible; MSIE 4.0)\r\n
wtv-show-time-record: 4 <wtv-home:/home?>\r\n
wtv-request-type: primary\r\n
wtv-incarnation: 14\r\n
Content-type: application/octet-stream\r\n
Content-length: 36\r\n
\r\n
/fkMTtAd552bhZFIlVHbHcEI5kTa5kTO==QO
</pre>

The server will unswap the bytes, decode the data into its raw binary form, and then parse it as smart card data to determine what to do with it. While the specifics of the <code>wtv-smartcard</code> aren't well known, what is known is that the server will redirect the box to the website if the smart card data is for a "Go To" card and send an error page is the data is invalid.

In some cases, the box will send an error header (e.g: "error=-68") if something goes wrong.

User:Wtv-411/Smart Card

2023-08-05T18:22:18Z

Wtv-411: /* Version 2 */

{{WTVPNav}}

'''WIP'''

----

Smart Cards were used on the WebTV and first-generation MSN TV service to take the user to a site, set up ISP options, etc. They were rarely utilized, and were removed on the MSN TV 2.

WebTV/MSN TV boxes support smart cards that are compliant with the ISO-7816 standard. Smart cards can hold up to 122 bytes of data.

== Format ==

WebTV/MSN TV smart cards use a proprietary format to store data. There are two known versions of the format that WebTV Networks developed: version 1 and version 2. The only smart card known to be produced for WebTV boxes (the Sony smart card bundled with Sony INT-W200 Internet Terminals) uses the version 2 format, though.

Thanks to internal WebTV pages from a "smart card factory" service containing JavaScript that directly handled writing in both formats, these formats have been able to be reverse engineered to varying degrees of success. This page will currently only cover the version 2 smart card format though, since that is the format we have the most information on.

=== Version 2 ===
Version 2 smart cards make use of a header and TLVs (type-length-value) to store data. Version 2 smart card data can have one TLV at minimum for the main card data that corresponds to the card type in the header. If the card type is not a deregistration card, the data can also contain an optional title TLV, which has to precede all other TLVs and contains text for a title that will be displayed when the smart card is inserted into the box. Multiple TLVs in general can be added if the card type isn't deregistration or if it is set to be a "multi" card.

{| class="wikitable"
|-
! Offset
! Length
! Description
|-
| 0x00
| 1 byte
| Version identifier. Always <code>2</code> (0x32)
|-
| 0x01
| 1 byte
| Card type
|-
| 0x02
| 1 byte
| CRC value. This is an optional field and a value of 0xff can be specified to make WebTV/MSN TV ignore the CRC
|-
| 0x03
| Variable
| TLV data
|}

TLVs are simple structures that store data under certain types. They can technically hold up to 256 bytes of data, and follow this format:

{| class="wikitable"
|-
! Field
! Type
! Description
|-
| Type
| uint8
| Type code
|-
| Length
| uint8
| 8-bit length of value
|-
| Value
| Byte array
| Variable length value data
|}

==== Known Card Types ====
* A - '''A'''ffinity. This feature is currently undocumented, but involves an enrollment and program code
* F - '''F'''avorites
* W - Deregistration. Only the deregstration TLV can be present in the smart card data if this type is set
* O - '''O'''penISP (Use your own ISP)
* G - '''G'''o To (a website)
* M - Multi-card. Stores TLVs for different card types

==== Known TLVs ====
TLVs will be listed by their type code

===== "t" (Title) =====
* Description: Specifies a title to give the smart card. Optional, but has to precede all other TLVs. This TLV can '''not''' be present in deregistration smart cards
* Value: The title for the smart card

===== "A" (Affinity data) =====
* Description: Required for Affinity smart cards
* Value: Structure. A byte for the version number (either <code>1</code> for version 1 Affinity data or <code>2</code> for version 2 Affinity data), followed by the actual data.
** For version 2 Affinity data: The format is the program code, a tab character (0x09), and the enrollment code
** For version 1 Affinity data: Just the enrollment code is added

===== "G" (Go To data) =====
* Description: Data that defines a website the smart card will make the box access. The wtv-smartcard service would have taken care of redirecting the client to the specified site if it existed. Required for "Go To" smart cards
* Value: A byte for the type of website to be accessed (<code>i</code> - Server-side numeric ID that will be translated by the WebTV/MSN TV service, <code>h</code> - HTTP URL, <code>s</code> - HTTPS URL), followed by a numeric ID if the type is <code>i</code>, or the direct URL for the site without the "http(s)://" prefix.

===== "O" (OpenISP) =====
* Description: Data for setting up a predefined custom ISP to connect to WebTV/MSN TV with. Required for OpenISP smart cards
* Value: "1", followed by the ISP information separated with a tab character (0x09)

ISP information structure:
* ISP name - String
* 0x09 separator
* ISP login name - String
* 0x09 separator
* ISP password - String
* 0x09 separator
* Primary modem number - 10-digit phone number
* 0x09 separator
* Backup modem number - 10-digit phone number. Optional

===== "W" (Deregistration) =====
* Description: Data for de-registering a client. If this TLV is used, then the card type '''must''' be set to deregistration as well and no other TLVs may be added
* Value: Binary structure

Deregistration data structure:

{| class="wikitable"
|-
! Offset
! Length
! Description
|-
| 0x00
| 4 bytes
| Contains a specific sequence of bytes (in hex: <code>31 75 fa b0</code>). Purpose for these is unknown
|-
| 0x04
| 4 bytes
| A UNIX timestamp for when the deregistration card expires. On the WebTV smart card factory pages, this is always set to 0xffffffff to set it to not expire
|-
| 0x08
| Variable
| Deregistration code
|}

==== Example ====
The following example shows a break down of the data from an official Sony INT-W200 smart card, which uses the version 2 smart card format and is a "Go to" card. The card would have originally sent to the service a site ID of 999999, which would redirect the user to the Sony-operated site <code>http://svalue.com</code> (no longer run by Sony).

{| class="wikitable"
|-
! Field
! Value
|-
| Version
| "2" (0x32)
|-
| Type
| "G" (Go to)
|-
| CRC
| 0xFF (Ignore)
|-
| TLV #1 Type
| "t" (Title)
|-
| TLV #1 Length
| 0x0B
|-
| TLV #1 Value
| "Sony Value "
|-
| TLV #2 Type
| "G" (Go to)
|-
| TLV #2 Length
| 0x07
|-
| TLV #2 Value
| "i999999" (Server-side numeric ID 999999 - points to http://svalue.com on the original server)
|}

'''TODO'''


== Service Side ==
When a smart card is inserted into the WebTV/MSN TV receiver, it will show a message on the screen with the smart card name and a progress bar. In the background, the box will contact the URL from the <code>wtv-smartcard-inserted-url</code> header sent from headwaiter, which is usually <code>wtv-smartcard:/insert</code>. The box will <code>POST</code> the raw data read from the card to the URL. While official clients can supposedly send the smart card data raw, it has only been documented to send the data as a Base64 encoded string with every 4 bytes swapped:

<pre>
POST wtv-smartcard:/insert\r\n
User-Agent: Mozilla/4.0 WebTV/2.6 (compatible; MSIE 4.0)\r\n
wtv-show-time-record: 4 <wtv-home:/home?>\r\n
wtv-request-type: primary\r\n
wtv-incarnation: 14\r\n
Content-type: application/octet-stream\r\n
Content-length: 36\r\n
\r\n
/fkMTtAd552bhZFIlVHbHcEI5kTa5kTO==QO
</pre>

The server will unswap the bytes, decode the data into its raw binary form, and then parse it as smart card data to determine what to do with it. While the specifics of the <code>wtv-smartcard</code> aren't well known, what is known is that the server will redirect the box to the website if the smart card data is for a "Go To" card and send an error page is the data is invalid.

In some cases, the box will send an error header (e.g: "error=-68") if something goes wrong.

User:Wtv-411/Smart Card

2023-08-05T18:02:22Z

Wtv-411: /* "O" (OpenISP) */

{{WTVPNav}}

'''WIP'''

----

Smart Cards were used on the WebTV and first-generation MSN TV service to take the user to a site, set up ISP options, etc. They were rarely utilized, and were removed on the MSN TV 2.

WebTV/MSN TV boxes support smart cards that are compliant with the ISO-7816 standard. Smart cards can hold up to 122 bytes of data.

== Format ==

WebTV/MSN TV smart cards use a proprietary format to store data. There are two known versions of the format that WebTV Networks developed: version 1 and version 2. The only smart card known to be produced for WebTV boxes (the Sony smart card bundled with Sony INT-W200 Internet Terminals) uses the version 2 format, though.

Thanks to internal WebTV pages from a "smart card factory" service containing JavaScript that directly handled writing in both formats, these formats have been able to be reverse engineered to varying degrees of success. This page will currently only cover the version 2 smart card format though, since that is the format we have the most information on.

=== Version 2 ===
Version 2 smart cards make use of a header and TLVs (type-length-value) to store data. Version 2 smart card data can have one TLV at minimum for the main card data that corresponds to the card type in the header. If the card type is not a deregistration card, the data can also contain an optional title TLV, which has to precede all other TLVs and contains text for a title that will be displayed when the smart card is inserted into the box. Multiple TLVs in general can be added if the card type isn't deregistration or if it is set to be a "multi" card.

{| class="wikitable"
|-
! Offset
! Length
! Description
|-
| 0x00
| 1 byte
| Version identifier. Always <code>2</code> (0x32)
|-
| 0x01
| 1 byte
| Card type
|-
| 0x02
| 1 byte
| CRC value. This is an optional field and a value of 0xff can be specified to make WebTV/MSN TV ignore the CRC
|-
| 0x03
| Variable
| TLV data
|}

TLVs are simple structures that store data under certain types. They can technically hold up to 256 bytes of data, and follow this format:

{| class="wikitable"
|-
! Field
! Type
! Description
|-
| Type
| uint8
| Type value
|-
| Length
| uint8
| 8-bit length of value
|-
| Value
| Byte array
| Variable length value data
|}

==== Known Card Types ====
* A - '''A'''ffinity. This feature is currently undocumented, but involves an enrollment and program code
* F - '''F'''avorites
* W - Deregistration. Only the deregstration TLV can be present in the smart card data if this type is set
* O - '''O'''penISP (Use your own ISP)
* G - '''G'''o To (a website)
* M - Multi-card. Stores TLVs for different card types

==== Known TLVs ====
TLVs will be listed by their type code

===== "t" (Title) =====
* Description: Specifies a title to give the smart card. Optional, but has to precede all other TLVs. This TLV can '''not''' be present in deregistration smart cards
* Value: The title for the smart card

===== "A" (Affinity data) =====
* Description: Required for Affinity smart cards
* Value: Structure. A byte for the version number (either <code>1</code> for version 1 Affinity data or <code>2</code> for version 2 Affinity data), followed by the actual data.
** For version 2 Affinity data: The format is the program code, a tab character (0x09), and the enrollment code
** For version 1 Affinity data: Just the enrollment code is added

===== "G" (Go To data) =====
* Description: Data that defines a website the smart card will make the box access. The wtv-smartcard service would have taken care of redirecting the client to the specified site if it existed. Required for "Go To" smart cards
* Value: A byte for the type of website to be accessed (<code>i</code> - Server-side numeric ID that will be translated by the WebTV/MSN TV service, <code>h</code> - HTTP URL, <code>s</code> - HTTPS URL), followed by a numeric ID if the type is <code>i</code>, or the direct URL for the site without the "http(s)://" prefix.

===== "O" (OpenISP) =====
* Description: Data for setting up a predefined custom ISP to connect to WebTV/MSN TV with. Required for OpenISP smart cards
* Value: "1", followed by the ISP information separated with a tab character (0x09)

ISP information structure:
* ISP name - String
* 0x09 separator
* ISP login name - String
* 0x09 separator
* ISP password - String
* 0x09 separator
* Primary modem number - 10-digit phone number
* 0x09 separator
* Backup modem number - 10-digit phone number. Optional

===== "W" (Deregistration) =====
* Description: Data for de-registering a client. If this TLV is used, then the card type '''must''' be set to deregistration as well and no other TLVs may be added
* Value: Binary structure

Deregistration data structure:

{| class="wikitable"
|-
! Offset
! Length
! Description
|-
| 0x00
| 4 bytes
| Contains a specific sequence of bytes (in hex: <code>31 75 fa b0</code>). Purpose for these is unknown
|-
| 0x04
| 4 bytes
| A UNIX timestamp for when the deregistration card expires. On the WebTV smart card factory pages, this is always set to 0xffffffff to set it to not expire
|-
| 0x08
| Variable
| Deregistration code
|}

==== Example ====
The following example shows a break down of the data from an official Sony INT-W200 smart card, which uses the version 2 smart card format and is a "Go to" card. The card would have originally sent to the service a site ID of 999999, which would redirect the user to the Sony-operated site <code>http://svalue.com</code> (no longer run by Sony).

{| class="wikitable"
|-
! Field
! Value
|-
| Version
| "2" (0x32)
|-
| Type
| "G" (Go to)
|-
| CRC
| 0xFF (Ignore)
|-
| TLV #1 Type
| "t" (Title)
|-
| TLV #1 Length
| 0x0B
|-
| TLV #1 Value
| "Sony Value "
|-
| TLV #2 Type
| "G" (Go to)
|-
| TLV #2 Length
| 0x07
|-
| TLV #2 Value
| "i999999" (Server-side numeric ID 999999 - points to http://svalue.com on the original server)
|}

'''TODO'''


== Service Side ==
When a smart card is inserted into the WebTV/MSN TV receiver, it will show a message on the screen with the smart card name and a progress bar. In the background, the box will contact the URL from the <code>wtv-smartcard-inserted-url</code> header sent from headwaiter, which is usually <code>wtv-smartcard:/insert</code>. The box will <code>POST</code> the raw data read from the card to the URL. While official clients can supposedly send the smart card data raw, it has only been documented to send the data as a Base64 encoded string with every 4 bytes swapped:

<pre>
POST wtv-smartcard:/insert\r\n
User-Agent: Mozilla/4.0 WebTV/2.6 (compatible; MSIE 4.0)\r\n
wtv-show-time-record: 4 <wtv-home:/home?>\r\n
wtv-request-type: primary\r\n
wtv-incarnation: 14\r\n
Content-type: application/octet-stream\r\n
Content-length: 36\r\n
\r\n
/fkMTtAd552bhZFIlVHbHcEI5kTa5kTO==QO
</pre>

The server will unswap the bytes, decode the data into its raw binary form, and then parse it as smart card data to determine what to do with it. While the specifics of the <code>wtv-smartcard</code> aren't well known, what is known is that the server will redirect the box to the website if the smart card data is for a "Go To" card and send an error page is the data is invalid.

In some cases, the box will send an error header (e.g: "error=-68") if something goes wrong.

User:Wtv-411/Smart Card

2023-08-05T18:00:40Z

Wtv-411: /* Version 2 */ Add example of data from official smart card and refine Go to TLV info

{{WTVPNav}}

'''WIP'''

----

Smart Cards were used on the WebTV and first-generation MSN TV service to take the user to a site, set up ISP options, etc. They were rarely utilized, and were removed on the MSN TV 2.

WebTV/MSN TV boxes support smart cards that are compliant with the ISO-7816 standard. Smart cards can hold up to 122 bytes of data.

== Format ==

WebTV/MSN TV smart cards use a proprietary format to store data. There are two known versions of the format that WebTV Networks developed: version 1 and version 2. The only smart card known to be produced for WebTV boxes (the Sony smart card bundled with Sony INT-W200 Internet Terminals) uses the version 2 format, though.

Thanks to internal WebTV pages from a "smart card factory" service containing JavaScript that directly handled writing in both formats, these formats have been able to be reverse engineered to varying degrees of success. This page will currently only cover the version 2 smart card format though, since that is the format we have the most information on.

=== Version 2 ===
Version 2 smart cards make use of a header and TLVs (type-length-value) to store data. Version 2 smart card data can have one TLV at minimum for the main card data that corresponds to the card type in the header. If the card type is not a deregistration card, the data can also contain an optional title TLV, which has to precede all other TLVs and contains text for a title that will be displayed when the smart card is inserted into the box. Multiple TLVs in general can be added if the card type isn't deregistration or if it is set to be a "multi" card.

{| class="wikitable"
|-
! Offset
! Length
! Description
|-
| 0x00
| 1 byte
| Version identifier. Always <code>2</code> (0x32)
|-
| 0x01
| 1 byte
| Card type
|-
| 0x02
| 1 byte
| CRC value. This is an optional field and a value of 0xff can be specified to make WebTV/MSN TV ignore the CRC
|-
| 0x03
| Variable
| TLV data
|}

TLVs are simple structures that store data under certain types. They can technically hold up to 256 bytes of data, and follow this format:

{| class="wikitable"
|-
! Field
! Type
! Description
|-
| Type
| uint8
| Type value
|-
| Length
| uint8
| 8-bit length of value
|-
| Value
| Byte array
| Variable length value data
|}

==== Known Card Types ====
* A - '''A'''ffinity. This feature is currently undocumented, but involves an enrollment and program code
* F - '''F'''avorites
* W - Deregistration. Only the deregstration TLV can be present in the smart card data if this type is set
* O - '''O'''penISP (Use your own ISP)
* G - '''G'''o To (a website)
* M - Multi-card. Stores TLVs for different card types

==== Known TLVs ====
TLVs will be listed by their type code

===== "t" (Title) =====
* Description: Specifies a title to give the smart card. Optional, but has to precede all other TLVs. This TLV can '''not''' be present in deregistration smart cards
* Value: The title for the smart card

===== "A" (Affinity data) =====
* Description: Required for Affinity smart cards
* Value: Structure. A byte for the version number (either <code>1</code> for version 1 Affinity data or <code>2</code> for version 2 Affinity data), followed by the actual data.
** For version 2 Affinity data: The format is the program code, a tab character (0x09), and the enrollment code
** For version 1 Affinity data: Just the enrollment code is added

===== "G" (Go To data) =====
* Description: Data that defines a website the smart card will make the box access. The wtv-smartcard service would have taken care of redirecting the client to the specified site if it existed. Required for "Go To" smart cards
* Value: A byte for the type of website to be accessed (<code>i</code> - Server-side numeric ID that will be translated by the WebTV/MSN TV service, <code>h</code> - HTTP URL, <code>s</code> - HTTPS URL), followed by a numeric ID if the type is <code>i</code>, or the direct URL for the site without the "http(s)://" prefix.

===== "O" (OpenISP) =====
* Description: Data for setting up a predefined custom ISP to connect to WebTV/MSN TV with. Required for OpenISP smart cards
* Value: "1", followed by the ISP information separated with a tab character (0x09)
 
ISP information structure:
* ISP name - String
* 0x09 separator
* ISP login name - String
* 0x09 separator
* ISP password - String
* 0x09 separator
* Primary modem number - 10-digit phone number
* 0x09 separator
* Backup modem number - 10-digit phone number. Optional

===== "W" (Deregistration) =====
* Description: Data for de-registering a client. If this TLV is used, then the card type '''must''' be set to deregistration as well and no other TLVs may be added
* Value: Binary structure

Deregistration data structure:

{| class="wikitable"
|-
! Offset
! Length
! Description
|-
| 0x00
| 4 bytes
| Contains a specific sequence of bytes (in hex: <code>31 75 fa b0</code>). Purpose for these is unknown
|-
| 0x04
| 4 bytes
| A UNIX timestamp for when the deregistration card expires. On the WebTV smart card factory pages, this is always set to 0xffffffff to set it to not expire
|-
| 0x08
| Variable
| Deregistration code
|}

==== Example ====
The following example shows a break down of the data from an official Sony INT-W200 smart card, which uses the version 2 smart card format and is a "Go to" card. The card would have originally sent to the service a site ID of 999999, which would redirect the user to the Sony-operated site <code>http://svalue.com</code> (no longer run by Sony).

{| class="wikitable"
|-
! Field
! Value
|-
| Version
| "2" (0x32)
|-
| Type
| "G" (Go to)
|-
| CRC
| 0xFF (Ignore)
|-
| TLV #1 Type
| "t" (Title)
|-
| TLV #1 Length
| 0x0B
|-
| TLV #1 Value
| "Sony Value "
|-
| TLV #2 Type
| "G" (Go to)
|-
| TLV #2 Length
| 0x07
|-
| TLV #2 Value
| "i999999" (Server-side numeric ID 999999 - points to http://svalue.com on the original server)
|}

'''TODO'''


== Service Side ==
When a smart card is inserted into the WebTV/MSN TV receiver, it will show a message on the screen with the smart card name and a progress bar. In the background, the box will contact the URL from the <code>wtv-smartcard-inserted-url</code> header sent from headwaiter, which is usually <code>wtv-smartcard:/insert</code>. The box will <code>POST</code> the raw data read from the card to the URL. While official clients can supposedly send the smart card data raw, it has only been documented to send the data as a Base64 encoded string with every 4 bytes swapped:

<pre>
POST wtv-smartcard:/insert\r\n
User-Agent: Mozilla/4.0 WebTV/2.6 (compatible; MSIE 4.0)\r\n
wtv-show-time-record: 4 <wtv-home:/home?>\r\n
wtv-request-type: primary\r\n
wtv-incarnation: 14\r\n
Content-type: application/octet-stream\r\n
Content-length: 36\r\n
\r\n
/fkMTtAd552bhZFIlVHbHcEI5kTa5kTO==QO
</pre>

The server will unswap the bytes, decode the data into its raw binary form, and then parse it as smart card data to determine what to do with it. While the specifics of the <code>wtv-smartcard</code> aren't well known, what is known is that the server will redirect the box to the website if the smart card data is for a "Go To" card and send an error page is the data is invalid.

In some cases, the box will send an error header (e.g: "error=-68") if something goes wrong.

User:Wtv-411

2023-08-05T17:18:58Z

Wtv-411:

Former head honcho of the WebTV Wiki turned administrator. Also the resident WebTV/MSN TV tinkerer whenever I feel like it.

This user page will mostly be used to host drafts of WIP or updates to pages.

User:Wtv-411/Smart Card

2023-08-05T17:14:39Z

Wtv-411:

{{WTVPNav}}

'''WIP'''

----

Smart Cards were used on the WebTV and first-generation MSN TV service to take the user to a site, set up ISP options, etc. They were rarely utilized, and were removed on the MSN TV 2.

WebTV/MSN TV boxes support smart cards that are compliant with the ISO-7816 standard. Smart cards can hold up to 122 bytes of data.

== Format ==

WebTV/MSN TV smart cards use a proprietary format to store data. There are two known versions of the format that WebTV Networks developed: version 1 and version 2. The only smart card known to be produced for WebTV boxes (the Sony smart card bundled with Sony INT-W200 Internet Terminals) uses the version 2 format, though.

Thanks to internal WebTV pages from a "smart card factory" service containing JavaScript that directly handled writing in both formats, these formats have been able to be reverse engineered to varying degrees of success. This page will currently only cover the version 2 smart card format though, since that is the format we have the most information on.

=== Version 2 ===
Version 2 smart cards make use of a header and TLVs (type-length-value) to store data. Version 2 smart card data can have one TLV at minimum for the main card data that corresponds to the card type in the header. If the card type is not a deregistration card, the data can also contain an optional title TLV, which has to precede all other TLVs and contains text for a title that will be displayed when the smart card is inserted into the box. Multiple TLVs in general can be added if the card type isn't deregistration or if it is set to be a "multi" card.

{| class="wikitable"
|-
! Offset
! Length
! Description
|-
| 0x00
| 1 byte
| Version identifier. Always <code>2</code> (0x32)
|-
| 0x01
| 1 byte
| Card type
|-
| 0x02
| 1 byte
| CRC value. This is an optional field and a value of 0xff can be specified to make WebTV/MSN TV ignore the CRC
|-
| 0x03
| Variable
| TLV data
|}

TLVs are simple structures that store data under certain types. They can technically hold up to 256 bytes of data, and follow this format:

{| class="wikitable"
|-
! Field
! Type
! Description
|-
| Type
| uint8
| Type value
|-
| Length
| uint8
| 8-bit length of value
|-
| Value
| Byte array
| Variable length value data
|}

==== Known Card Types ====
* A - '''A'''ffinity. This feature is currently undocumented, but involves an enrollment and program code
* F - '''F'''avorites
* W - Deregistration. Only the deregstration TLV can be present in the smart card data if this type is set
* O - '''O'''penISP (Use your own ISP)
* G - '''G'''o To (a website)
* M - Multi-card. Stores TLVs for different card types

==== Known TLVs ====
TLVs will be listed by their type code

===== "t" (Title) =====
* Description: Specifies a title to give the smart card. Optional, but has to precede all other TLVs. This TLV can '''not''' be present in deregistration smart cards
* Value: The title for the smart card

===== "A" (Affinity data) =====
* Description: Required for Affinity smart cards
* Value: Structure. A byte for the version number (either <code>1</code> for version 1 Affinity data or <code>2</code> for version 2 Affinity data), followed by the actual data.
** For version 2 Affinity data: The format is the program code, a tab character (0x09), and the enrollment code
** For version 1 Affinity data: Just the enrollment code is added

===== "G" (Go To data) =====
* Description: Data that defines a website the smart card will make the box access. Required for "Go To" smart cards
* Value: Structure. A byte for the type of website to be accessed (<code>i</code> - Server-side numeric ID that will be translated by the WebTV/MSN TV service, <code>h</code> - HTTP URL, <code>s</code> - HTTPS URL), followed by a numeric ID if the type is <code>i</code>, or the direct URL for the site without the "http(s)://" prefix.

===== "O" (OpenISP) =====
* Description: Data for setting up a predefined custom ISP to connect to WebTV/MSN TV with. Required for OpenISP smart cards
* Value: "1", followed by the ISP information separated with a tab character (0x09)
 
ISP information structure:
* ISP name - String
* 0x09 separator
* ISP login name - String
* 0x09 separator
* ISP password - String
* 0x09 separator
* Primary modem number - 10-digit phone number
* 0x09 separator
* Backup modem number - 10-digit phone number. Optional

===== "W" (Deregistration) =====
* Description: Data for de-registering a client. If this TLV is used, then the card type '''must''' be set to deregistration as well and no other TLVs may be added
* Value: Binary structure

Deregistration data structure:

{| class="wikitable"
|-
! Offset
! Length
! Description
|-
| 0x00
| 4 bytes
| Contains a specific sequence of bytes (in hex: <code>31 75 fa b0</code>). Purpose for these is unknown
|-
| 0x04
| 4 bytes
| A UNIX timestamp for when the deregistration card expires. On the WebTV smart card factory pages, this is always set to 0xffffffff to set it to not expire
|-
| 0x08
| Variable
| Deregistration code
|}

'''TODO'''



== Service Side ==
When a smart card is inserted into the WebTV/MSN TV receiver, it will show a message on the screen with the smart card name and a progress bar. In the background, the box will contact the URL from the <code>wtv-smartcard-inserted-url</code> header sent from headwaiter, which is usually <code>wtv-smartcard:/insert</code>. The box will <code>POST</code> the raw data read from the card to the URL. While official clients can supposedly send the smart card data raw, it has only been documented to send the data as a Base64 encoded string with every 4 bytes swapped:

<pre>
POST wtv-smartcard:/insert\r\n
User-Agent: Mozilla/4.0 WebTV/2.6 (compatible; MSIE 4.0)\r\n
wtv-show-time-record: 4 <wtv-home:/home?>\r\n
wtv-request-type: primary\r\n
wtv-incarnation: 14\r\n
Content-type: application/octet-stream\r\n
Content-length: 36\r\n
\r\n
/fkMTtAd552bhZFIlVHbHcEI5kTa5kTO==QO
</pre>

The server will unswap the bytes, decode the data into its raw binary form, and then parse it as smart card data to determine what to do with it. While the specifics of the <code>wtv-smartcard</code> aren't well known, what is known is that the server will redirect the box to the website if the smart card data is for a "Go To" card and send an error page is the data is invalid.

In some cases, the box will send an error header (e.g: "error=-68") if something goes wrong.

User:Wtv-411/Smart Card

2023-08-05T17:13:31Z

Wtv-411: /* Format */

{{WTVPNav}}

'''WIP'''

----

Smart Cards were used on the WebTV and first-generation MSN TV service to take the user to a site, set up ISP options, etc. They were rarely utilized, and were removed on the MSN TV 2.

WebTV/MSN TV boxes support smart cards that are compliant with the ISO-7816 standard, and can hold up to 122 bytes of data.

== Format ==

WebTV/MSN TV smart cards use a proprietary format to store data. There are two known versions of the format that WebTV Networks developed: version 1 and version 2. The only smart card known to be produced for WebTV boxes (the Sony smart card bundled with Sony INT-W200 Internet Terminals) uses the version 2 format, though.

Thanks to internal WebTV pages from a "smart card factory" service containing JavaScript that directly handled writing in both formats, these formats have been able to be reverse engineered to varying degrees of success. This page will currently only cover the version 2 smart card format though, since that is the format we have the most information on.

=== Version 2 ===
Version 2 smart cards make use of a header and TLVs (type-length-value) to store data. Version 2 smart card data can have one TLV at minimum for the main card data that corresponds to the card type in the header. If the card type is not a deregistration card, the data can also contain an optional title TLV, which has to precede all other TLVs and contains text for a title that will be displayed when the smart card is inserted into the box. Multiple TLVs in general can be added if the card type isn't deregistration or if it is set to be a "multi" card.

{| class="wikitable"
|-
! Offset
! Length
! Description
|-
| 0x00
| 1 byte
| Version identifier. Always <code>2</code> (0x32)
|-
| 0x01
| 1 byte
| Card type
|-
| 0x02
| 1 byte
| CRC value. This is an optional field and a value of 0xff can be specified to make WebTV/MSN TV ignore the CRC
|-
| 0x03
| Variable
| TLV data
|}

TLVs are simple structures that store data under certain types. They can technically hold up to 256 bytes of data, and follow this format:

{| class="wikitable"
|-
! Field
! Type
! Description
|-
| Type
| uint8
| Type value
|-
| Length
| uint8
| 8-bit length of value
|-
| Value
| Byte array
| Variable length value data
|}

==== Known Card Types ====
* A - '''A'''ffinity. This feature is currently undocumented, but involves an enrollment and program code
* F - '''F'''avorites
* W - Deregistration. Only the deregstration TLV can be present in the smart card data if this type is set
* O - '''O'''penISP (Use your own ISP)
* G - '''G'''o To (a website)
* M - Multi-card. Stores TLVs for different card types

==== Known TLVs ====
TLVs will be listed by their type code

===== "t" (Title) =====
* Description: Specifies a title to give the smart card. Optional, but has to precede all other TLVs. This TLV can '''not''' be present in deregistration smart cards
* Value: The title for the smart card

===== "A" (Affinity data) =====
* Description: Required for Affinity smart cards
* Value: Structure. A byte for the version number (either <code>1</code> for version 1 Affinity data or <code>2</code> for version 2 Affinity data), followed by the actual data.
** For version 2 Affinity data: The format is the program code, a tab character (0x09), and the enrollment code
** For version 1 Affinity data: Just the enrollment code is added

===== "G" (Go To data) =====
* Description: Data that defines a website the smart card will make the box access. Required for "Go To" smart cards
* Value: Structure. A byte for the type of website to be accessed (<code>i</code> - Server-side numeric ID that will be translated by the WebTV/MSN TV service, <code>h</code> - HTTP URL, <code>s</code> - HTTPS URL), followed by a numeric ID if the type is <code>i</code>, or the direct URL for the site without the "http(s)://" prefix.

===== "O" (OpenISP) =====
* Description: Data for setting up a predefined custom ISP to connect to WebTV/MSN TV with. Required for OpenISP smart cards
* Value: "1", followed by the ISP information separated with a tab character (0x09)
 
ISP information structure:
* ISP name - String
* 0x09 separator
* ISP login name - String
* 0x09 separator
* ISP password - String
* 0x09 separator
* Primary modem number - 10-digit phone number
* 0x09 separator
* Backup modem number - 10-digit phone number. Optional

===== "W" (Deregistration) =====
* Description: Data for de-registering a client. If this TLV is used, then the card type '''must''' be set to deregistration as well and no other TLVs may be added
* Value: Binary structure

Deregistration data structure:

{| class="wikitable"
|-
! Offset
! Length
! Description
|-
| 0x00
| 4 bytes
| Contains a specific sequence of bytes (in hex: <code>31 75 fa b0</code>). Purpose for these is unknown
|-
| 0x04
| 4 bytes
| A UNIX timestamp for when the deregistration card expires. On the WebTV smart card factory pages, this is always set to 0xffffffff to set it to not expire
|-
| 0x08
| Variable
| Deregistration code
|}

'''TODO'''



== Service Side ==
When a smart card is inserted into the WebTV/MSN TV receiver, it will show a message on the screen with the smart card name and a progress bar. In the background, the box will contact the URL from the <code>wtv-smartcard-inserted-url</code> header sent from headwaiter, which is usually <code>wtv-smartcard:/insert</code>. The box will <code>POST</code> the raw data read from the card to the URL. While official clients can supposedly send the smart card data raw, it has only been documented to send the data as a Base64 encoded string with every 4 bytes swapped:

<pre>
POST wtv-smartcard:/insert\r\n
User-Agent: Mozilla/4.0 WebTV/2.6 (compatible; MSIE 4.0)\r\n
wtv-show-time-record: 4 <wtv-home:/home?>\r\n
wtv-request-type: primary\r\n
wtv-incarnation: 14\r\n
Content-type: application/octet-stream\r\n
Content-length: 36\r\n
\r\n
/fkMTtAd552bhZFIlVHbHcEI5kTa5kTO==QO
</pre>

The server will unswap the bytes, decode the data into its raw binary form, and then parse it as smart card data to determine what to do with it. While the specifics of the <code>wtv-smartcard</code> aren't well known, what is known is that the server will redirect the box to the website if the smart card data is for a "Go To" card and send an error page is the data is invalid.

In some cases, the box will send an error header (e.g: "error=-68") if something goes wrong.

User:Wtv-411/Smart Card

2023-08-05T17:13:09Z

Wtv-411: /* Known TLVs */ Add info on the rest of the TLVs

{{WTVPNav}}

'''WIP'''

----

Smart Cards were used on the WebTV and first-generation MSN TV service to take the user to a site, set up ISP options, etc. They were rarely utilized, and were removed on the MSN TV 2.

WebTV/MSN TV boxes support smart cards that are compliant with the ISO-7816 standard, and can hold up to 122 bytes of data.

== Format ==

WebTV/MSN TV smart cards use a proprietary format to store data. There are two known versions of the format WebTV Networks developed: version 1 and version 2. The only smart card known to be produced for WebTV boxes (the Sony smart card bundled with Sony INT-W200 Internet Terminals) uses the version 2 format, though.

Thanks to internal WebTV pages from a "smart card factory" service containing JavaScript that directly handled writing in both formats, these formats have been able to be reverse engineered to varying degrees of success. This page will currently only cover the version 2 smart card format though, since that is the format we have the most information on.

=== Version 2 ===
Version 2 smart cards make use of a header and TLVs (type-length-value) to store data. Version 2 smart card data can have one TLV at minimum for the main card data that corresponds to the card type in the header. If the card type is not a deregistration card, the data can also contain an optional title TLV, which has to precede all other TLVs and contains text for a title that will be displayed when the smart card is inserted into the box. Multiple TLVs in general can be added if the card type isn't deregistration or if it is set to be a "multi" card.

{| class="wikitable"
|-
! Offset
! Length
! Description
|-
| 0x00
| 1 byte
| Version identifier. Always <code>2</code> (0x32)
|-
| 0x01
| 1 byte
| Card type
|-
| 0x02
| 1 byte
| CRC value. This is an optional field and a value of 0xff can be specified to make WebTV/MSN TV ignore the CRC
|-
| 0x03
| Variable
| TLV data
|}

TLVs are simple structures that store data under certain types. They can technically hold up to 256 bytes of data, and follow this format:

{| class="wikitable"
|-
! Field
! Type
! Description
|-
| Type
| uint8
| Type value
|-
| Length
| uint8
| 8-bit length of value
|-
| Value
| Byte array
| Variable length value data
|}

==== Known Card Types ====
* A - '''A'''ffinity. This feature is currently undocumented, but involves an enrollment and program code
* F - '''F'''avorites
* W - Deregistration. Only the deregstration TLV can be present in the smart card data if this type is set
* O - '''O'''penISP (Use your own ISP)
* G - '''G'''o To (a website)
* M - Multi-card. Stores TLVs for different card types

==== Known TLVs ====
TLVs will be listed by their type code

===== "t" (Title) =====
* Description: Specifies a title to give the smart card. Optional, but has to precede all other TLVs. This TLV can '''not''' be present in deregistration smart cards
* Value: The title for the smart card

===== "A" (Affinity data) =====
* Description: Required for Affinity smart cards
* Value: Structure. A byte for the version number (either <code>1</code> for version 1 Affinity data or <code>2</code> for version 2 Affinity data), followed by the actual data.
** For version 2 Affinity data: The format is the program code, a tab character (0x09), and the enrollment code
** For version 1 Affinity data: Just the enrollment code is added

===== "G" (Go To data) =====
* Description: Data that defines a website the smart card will make the box access. Required for "Go To" smart cards
* Value: Structure. A byte for the type of website to be accessed (<code>i</code> - Server-side numeric ID that will be translated by the WebTV/MSN TV service, <code>h</code> - HTTP URL, <code>s</code> - HTTPS URL), followed by a numeric ID if the type is <code>i</code>, or the direct URL for the site without the "http(s)://" prefix.

===== "O" (OpenISP) =====
* Description: Data for setting up a predefined custom ISP to connect to WebTV/MSN TV with. Required for OpenISP smart cards
* Value: "1", followed by the ISP information separated with a tab character (0x09)
 
ISP information structure:
* ISP name - String
* 0x09 separator
* ISP login name - String
* 0x09 separator
* ISP password - String
* 0x09 separator
* Primary modem number - 10-digit phone number
* 0x09 separator
* Backup modem number - 10-digit phone number. Optional

===== "W" (Deregistration) =====
* Description: Data for de-registering a client. If this TLV is used, then the card type '''must''' be set to deregistration as well and no other TLVs may be added
* Value: Binary structure

Deregistration data structure:

{| class="wikitable"
|-
! Offset
! Length
! Description
|-
| 0x00
| 4 bytes
| Contains a specific sequence of bytes (in hex: <code>31 75 fa b0</code>). Purpose for these is unknown
|-
| 0x04
| 4 bytes
| A UNIX timestamp for when the deregistration card expires. On the WebTV smart card factory pages, this is always set to 0xffffffff to set it to not expire
|-
| 0x08
| Variable
| Deregistration code
|}

'''TODO'''



== Service Side ==
When a smart card is inserted into the WebTV/MSN TV receiver, it will show a message on the screen with the smart card name and a progress bar. In the background, the box will contact the URL from the <code>wtv-smartcard-inserted-url</code> header sent from headwaiter, which is usually <code>wtv-smartcard:/insert</code>. The box will <code>POST</code> the raw data read from the card to the URL. While official clients can supposedly send the smart card data raw, it has only been documented to send the data as a Base64 encoded string with every 4 bytes swapped:

<pre>
POST wtv-smartcard:/insert\r\n
User-Agent: Mozilla/4.0 WebTV/2.6 (compatible; MSIE 4.0)\r\n
wtv-show-time-record: 4 <wtv-home:/home?>\r\n
wtv-request-type: primary\r\n
wtv-incarnation: 14\r\n
Content-type: application/octet-stream\r\n
Content-length: 36\r\n
\r\n
/fkMTtAd552bhZFIlVHbHcEI5kTa5kTO==QO
</pre>

The server will unswap the bytes, decode the data into its raw binary form, and then parse it as smart card data to determine what to do with it. While the specifics of the <code>wtv-smartcard</code> aren't well known, what is known is that the server will redirect the box to the website if the smart card data is for a "Go To" card and send an error page is the data is invalid.

In some cases, the box will send an error header (e.g: "error=-68") if something goes wrong.

User:Wtv-411/Smart Card

2023-08-05T15:31:12Z

Wtv-411: Add in documentation for V2 smart card TLVs

{{WTVPNav}}

'''WIP'''

----

Smart Cards were used on the WebTV and first-generation MSN TV service to take the user to a site, set up ISP options, etc. They were rarely utilized, and were removed on the MSN TV 2.

WebTV/MSN TV boxes support smart cards that are compliant with the ISO-7816 standard, and can hold up to 122 bytes of data.

== Format ==

WebTV/MSN TV smart cards use a proprietary format to store data. There are two known versions of the format WebTV Networks developed: version 1 and version 2. The only smart card known to be produced for WebTV boxes (the Sony smart card bundled with Sony INT-W200 Internet Terminals) uses the version 2 format, though.

Thanks to internal WebTV pages from a "smart card factory" service containing JavaScript that directly handled writing in both formats, these formats have been able to be reverse engineered to varying degrees of success. This page will currently only cover the version 2 smart card format though, since that is the format we have the most information on.

=== Version 2 ===
Version 2 smart cards make use of a header and TLVs (type-length-value) to store data. Version 2 smart card data can have one TLV at minimum for the main card data that corresponds to the card type in the header. If the card type is not a deregistration card, the data can also contain an optional title TLV, which has to precede all other TLVs and contains text for a title that will be displayed when the smart card is inserted into the box. Multiple TLVs in general can be added if the card type isn't deregistration or if it is set to be a "multi" card.

{| class="wikitable"
|-
! Offset
! Length
! Description
|-
| 0x00
| 1 byte
| Version identifier. Always <code>2</code> (0x32)
|-
| 0x01
| 1 byte
| Card type
|-
| 0x02
| 1 byte
| CRC value. This is an optional field and a value of 0xff can be specified to make WebTV/MSN TV ignore the CRC
|-
| 0x03
| Variable
| TLV data
|}

TLVs are simple structures that store data under certain types. They can technically hold up to 256 bytes of data, and follow this format:

{| class="wikitable"
|-
! Field
! Type
! Description
|-
| Type
| uint8
| Type value
|-
| Length
| uint8
| 8-bit length of value
|-
| Value
| Byte array
| Variable length value data
|}

==== Known Card Types ====
* A - '''A'''ffinity. This feature is currently undocumented, but involves an enrollment and program code
* F - '''F'''avorites
* W - Deregistration. Only the deregstration TLV can be present in the smart card data if this type is set
* O - '''O'''penISP (Use your own ISP)
* G - '''G'''o To (a website)
* M - Multi-card. Stores TLVs for different card types

==== Known TLVs ====
TLVs will be listed by their type code
* 0x74 ("t") - Title TLV
** Description: Specifies a title to give the smart card. Optional, but has to precede all other TLVs. This TLV can '''not''' be present in deregistration smart cards
** Value: The title for the smart card

* 0x41 ("A") - Affinity data
** Description: Required for Affinity smart cards
** Value: Structure. A byte for the version number (either <code>1</code> for version 1 Affinity data or <code>2</code> for version 2 Affinity data), followed by the actual data.
*** For version 2 Affinity data: The format is the program code, a tab character (0x09), and the enrollment code
*** For version 1 Affinity data: Just the enrollment code is added

* 0x47 ("G") - Go To data
** Description: Data that defines a website the smart card will make the box access. Required for "Go To" smart cards
** Value: Structure. A byte for the type of website to be accessed (<code>i</code> - Server-side numeric ID that will be translated by the WebTV/MSN TV service, <code>h</code> - HTTP URL, <code>s</code> - HTTPS URL), followed by a numeric ID if the type is <code>i</code>, or the direct URL for the site without the "http(s)://" prefix.

'''TODO'''

For now, we'll be focusing on Go To cards, as that's what we have info on.

This is the data stored on a Go To Smart Card:
<code>2Gÿt�Sony Value G�i999999</code>

We can break this data up into several parts to get all the data that the server decodes.

The first byte is the Smart Card generation, which appears to always be 2 except for a special type of Go To card, which uses generation 1. "Generation" is assumed to refer to the data format for the card, not a different version of Smart Cards themselves.

The second byte is the Smart Card type, which is (G)o To in this case. Other observed values include (O)penISP and (A)ffinity.

ÿ appears to be a separator, which is followed by t�, which defines the start of the Smart Card title.

G�i appears to stand for "Go To ID", which is the ID for the Go To card. The ID has a corresponding URL that is stored on the server. If the ID is unknown, then a message about the Smart Card being expired or not yet active is sent to the client. The reasoning for this approach appears to be due to the size limit of Smart Cards (around 25 bytes) and so malicious cards can't be spread around.

So, to recap:

Card Generation: 2
Card Type: G
Card Title: Sony Value
Card ID: 999999

== Service Side ==
When a smart card is inserted into the WebTV/MSN TV receiver, it will show a message on the screen with the smart card name and a progress bar. In the background, the box will contact the URL from the <code>wtv-smartcard-inserted-url</code> header sent from headwaiter, which is usually <code>wtv-smartcard:/insert</code>. The box will <code>POST</code> the raw data read from the card to the URL. While official clients can supposedly send the smart card data raw, it has only been documented to send the data as a Base64 encoded string with every 4 bytes swapped:

<pre>
POST wtv-smartcard:/insert\r\n
User-Agent: Mozilla/4.0 WebTV/2.6 (compatible; MSIE 4.0)\r\n
wtv-show-time-record: 4 <wtv-home:/home?>\r\n
wtv-request-type: primary\r\n
wtv-incarnation: 14\r\n
Content-type: application/octet-stream\r\n
Content-length: 36\r\n
\r\n
/fkMTtAd552bhZFIlVHbHcEI5kTa5kTO==QO
</pre>

The server will unswap the bytes, decode the data into its raw binary form, and then parse it as smart card data to determine what to do with it. While the specifics of the <code>wtv-smartcard</code> aren't well known, what is known is that the server will redirect the box to the website if the smart card data is for a "Go To" card and send an error page is the data is invalid.

In some cases, the box will send an error header (e.g: "error=-68") if something goes wrong.

User:Wtv-411/Smart Card

2023-08-05T04:51:06Z

Wtv-411:

User:Wtv-411/Smart Card

2023-08-05T03:27:02Z

Wtv-411: /* Format */

User:Wtv-411/Smart Card

2023-08-05T02:50:51Z

Wtv-411: /* Data Structure */

User:Wtv-411/Smart Card

2023-08-05T01:21:07Z

Wtv-411: /* Data Structure */