Wtv-411: /* Starting the Pre-Registration Process */ Add toll-free number used for US production clients

2023-07-13T15:26:31Z

Starting the Pre-Registration Process: Add toll-free number used for US production clients

← Older revision		Revision as of 11:26, 13 July 2023
Line 7:		Line 7:

	== Starting the Pre-Registration Process ==		== Starting the Pre-Registration Process ==
	How WebTV/MSN TV clients communicated with the WebTV/MSN TV network for the first time (no TellyScript installed) is by first dialing a toll-free 800 number (~~TODO: Specify~~ what ~~number this was if possible)~~. Once it is able to dial in to the ISP with this number, it will start connecting to the "frontend" servers which ~~understand~~ WTVP. On first-time connections, a client will try to connect to a <code>wtv-1800</code> server at IP 10.0.0.1, port 1615 through the ISP (this has been observed on Sony and Philips Magnavox Classic box, and a Sony WebTV Plus box), although on the [[WebTV for Dreamcast\|Dreamcast version]] of WebTV, it will connect to the IP 10.0.1.129. On a successful connection attempt, a WTVP <code>GET</code> request to service URL "wtv-1800:/preregister" will be sent:		How WebTV/MSN TV clients communicated with the WebTV/MSN TV network for the first time (no TellyScript installed) is by first dialing a toll-free number. For all US production clients, this number was 1-800-613-8199 (this number has since been decommissioned when the MSN TV service shut down). It's been reported that different types of clients (Daily, Weekly, etc.) use different phone numbers, but what these numbers were is currently unknown.

			Once the client is able to dial in to the WebTV/MSN TV ISP with this number, it will start connecting to the "frontend" servers, which use WTVP to communicate with clients. On first-time connections, a client will try to connect to a <code>wtv-1800</code> server at IP 10.0.0.1, port 1615 through the ISP (this has been observed on Sony and Philips Magnavox Classic box, and a Sony WebTV Plus box), although on the [[WebTV for Dreamcast\|Dreamcast version]] of WebTV, it will connect to the IP 10.0.1.129. On a successful connection attempt, a WTVP <code>GET</code> request to service URL "wtv-1800:/preregister" will be sent:

	GET wtv-1800:/preregister?scriptless-visit-reason=10&0\r\n		GET wtv-1800:/preregister?scriptless-visit-reason=10&0\r\n

imported>Admin at 02:35, 1 June 2021

2021-06-01T02:35:45Z

New page

{{WTVPNav}}

''This page currently will only focus on how the first-generation WebTV/MSN TV clients communicated through dial-up. Information on broadband WebTV/MSN TV (not MSNTV 2) will be added later when more information comes out on that.''

----

== Starting the Pre-Registration Process ==
How WebTV/MSN TV clients communicated with the WebTV/MSN TV network for the first time (no TellyScript installed) is by first dialing a toll-free 800 number (TODO: Specify what number this was if possible). Once it is able to dial in to the ISP with this number, it will start connecting to the "frontend" servers which understand WTVP. On first-time connections, a client will try to connect to a <code>wtv-1800</code> server at IP 10.0.0.1, port 1615 through the ISP (this has been observed on Sony and Philips Magnavox Classic box, and a Sony WebTV Plus box), although on the [[WebTV for Dreamcast|Dreamcast version]] of WebTV, it will connect to the IP 10.0.1.129. On a successful connection attempt, a WTVP <code>GET</code> request to service URL "wtv-1800:/preregister" will be sent:

GET wtv-1800:/preregister?scriptless-visit-reason=10&0\r\n
wtv-request-type: primary\r\n
wtv-system-cpuspeed: 166164662\r\n
wtv-system-sysconfig: 3116068\r\n
wtv-disk-size: 8006\r\n
wtv-incarnation: 2\r\n
Accept-Language: en\r\n
wtv-connect-session-id: cafa1348\r\n
wtv-client-serial-number: ''{SSID}''\r\n
wtv-system-version: 16276\r\n
wtv-capability-flags: ''{capability-flags}''\r\n
wtv-client-bootrom-version: 2046\r\n
wtv-client-rom-type: US-LC2-disk-0MB-8MB\r\n
wtv-system-chipversion: 53608448\r\n
User-Agent: Mozilla/4.0 WebTV/2.8.2 (compatible; MSIE 4.0)\r\n
wtv-encryption: true\r\n
wtv-script-id: 0\r\n
wtv-script-mod: 0\r\n
\r\n

The response the server sends is something along the lines of:

<pre>
200 OK\n
Connection: Keep-Alive\n
wtv-open-isp-disabled: false\n
wtv-visit: wtv-1800:/offer-open-isp-suggest-wtv-token-XXXXXXXXXX-YYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYY?t-baggage-parms=ani-950000000000\n
Content-length: 0\n
Content-type: text/html\n
\n
</pre>

The purpose of the "wtv-1800:/offer-open-isp-suggest" URL in the <code>wtv-visit</code> header isn't entirely clear, but the client will go to the URL as instructed by the header and send a <code>GET</code> request to it. This URL also carries a <code>t-baggage-parms</code> query string that we cannot figure out, but it contains various "ani" parameters.

== "offer-open-isp-suggest" ==
We don't know what "wtv-1800:/offer-open-isp-suggest" does exactly, but the WebTV/MSN TV client will send a <code>GET</code> request for this after being instructed to do so by "wtv-1800:/preregister". The response it gets from the request is the following:

<pre>
200 OK\n
Connection: Keep-Alive\n
wtv-service: reset\n
wtv-service: name=wtv-1800 host=xxx.xxx.xxx.xxx port=1615 flags=0x00000004\n
wtv-phone-log-url: wtv-1800:/post-phone-log?t-baggage-parms=ani-950000000000\n
Content-length: 0\n
Content-type: text/html\n
\n
</pre>

This is the first time we see the <code>wtv-service</code> command header being used, resetting the service list on the client and adding a service entry for <code>wtv-1800</code> to an IP address on port 1615. A <code>wtv-phone-log-url</code> header is also added, pointing to "wtv-1800:/post-phone-log" with another <code>t-baggage-parms</code> query string.

== "post-phone-log" ==
At least from observing network traffic from a hacked WebTV Viewer, it is assumed a client will immediately <code>POST</code> to the phone log URL with an entity body of binary nonsense we can't make out at the moment:

POST wtv-1800:/post-phone-log?t-baggage-parms=ani-950000000000\r\n
wtv-system-cpuspeed: 166164662\r\n
wtv-system-sysconfig: 3116068\r\n
wtv-disk-size: 8006\r\n
wtv-incarnation: 3\r\n
Accept-Language: en\r\n
wtv-connect-session-id: cafa1348\r\n
wtv-client-serial-number: ''{SSID}''\r\n
wtv-system-version: 16276\r\n
wtv-capability-flags: ''{capability-flags}''\r\n
wtv-client-bootrom-version: 2046\r\n
wtv-client-rom-type: US-LC2-disk-0MB-8MB\r\n
wtv-system-chipversion: 53608448\r\n
User-Agent: Mozilla/4.0 WebTV/2.8.2 (compatible; MSIE 4.0)\r\n
wtv-encryption: true\r\n
wtv-script-id: 0\r\n
wtv-script-mod: 0\r\n
Content-type: application/octet-stream\r\n
Content-length: 330\r\n
\r\n

<pre>
00 42 00 1e 00 00 00 00 00 00 00 00 00 00 00 00 .B..............
00 00 00 00 00 00 00 00 00 00 00 00 00 00 0a fe ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 0c 38 07 27 5e c0 ...........8.'^.
f5 ab 34 0d 38 07 27 5e 00 10 38 07 27 5e 00 08 ..4.8.'^..8.'^..
3a 07 27 5e 00 00 00 00 00 00 00 00 10 3a 07 27 :.'^.........:.'
5e 00 06 59 07 27 5e 17 59 07 27 5e 01 06 59 07 ^..Y.'^.Y.'^..Y.
27 5e 0c 33 08 27 5e c0 f5 ab 34 0d 33 08 27 5e '^.3.'^...4.3.'^
00 10 33 08 27 5e 00 08 63 08 27 5e 00 00 00 00 ..3.'^..c.'^....
00 00 00 00 06 63 08 27 5e 0c 3d 21 27 5e c0 f5 .....c.'^.=!'^..
ab 34 0d 3d 21 27 5e 00 10 3d 21 27 5e 00 08 41 .4.=!'^..=!'^..A
21 27 5e 00 00 00 00 00 00 00 00 10 41 21 27 5e !'^.........A!'^
00 10 49 21 27 5e 00 14 57 21 27 5e 49 21 27 5e ..I!'^..W!'^I!'^
00 00 00 00 00 00 10 57 21 27 5e 00 06 67 21 27 .......W!'^..g!'
5e 17 67 21 27 5e 01 06 67 21 27 5e 0c cc 77 27 ^.g!'^..g!'^..w'
5e c0 f5 ab 34 0d cc 77 27 5e 00 10 cc 77 27 5e ^...4..w'^...w'^
00 08 f1 77 27 5e 00 00 00 00 00 00 00 00 10 f1 ...w'^..........
77 27 5e 00 10 0a 78 27 5e 00 w'^...x'^.
</pre>

Whatever this request does, the server sends back another response to make the client redirect to another <code>wtv-1800</code> URL, which is the most important one in this transaction:

<pre>
200 OK\n
Connection: Keep-Alive\n
wtv-service: reset\n
wtv-service: name=wtv-1800 host=xxx.xxx.xxx.xxx port=1615 flags=0x00000004\n
wtv-visit: wtv-1800:/finish-prereg-wtv-token-XXXXXXXXXX-YYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYY?t-baggage-parms=ani-950000000000\n
Content-length: 0\n
Content-type: text/html\n
\n
</pre>

== TellyScript/wtv-initial-key retrieval ("wtv-1800:/finish-prereg") ==
The "wtv-1800:/finish-prereg" URL is now <code>GET</code>ed by the client, and the server in response gives it two things it needs: the TellyScript and a "wtv-initial-key" value:

<pre>
200 OK\n
Connection: Keep-Alive\n
wtv-initial-key: Hpp+AZ85Vbs=\n
Content-Type: text/tellyscript\n
wtv-service: reset\n
wtv-service: name=wtv-head-waiter host=xxx.xxx.xxx.xxx port=1601 flags=0x00000001 connections=1\n
wtv-service: name=wtv-* host=xxx.xxx.xxx.xxx port=1603 flags=0x00000007\n
wtv-service: name=wtv-flashrom host=xxx.xxx.xxx.xxx port=1618 flags=0x00000040\n
wtv-boot-url: wtv-head-waiter:/login?\n
wtv-visit: wtv-head-waiter:/login?\n
wtv-client-time-zone: PST -0800\n
wtv-client-time-dst-rule: PST\n
wtv-client-date: Tue, 21 Jan 2020 22:15:43 GMT\n
Content-length: xxxx\n
\n
{TellyScript data}
</pre>

The TellyScript gives the client a list of local access numbers for the connecting user's area to dial in order to access the WebTV/MSN TV network. Along with the TellyScript, the <code>wtv-1800</code> server also sends the client a new round robin list for services <code>wtv-head-waiter</code>, <code>wtv-*</code>, and <code>wtv-flashrom</code>. One that'll be important for this process and future connections for when the client is started up again is <code>wtv-head-waiter</code>. This is the headwaiter server that the client authenticates through to access WebTV/MSN TV services. The "wtv-initial-key" value the server sends is a Base64-encoded 8-byte BLOB that facilitates challenge/response when [[WTVP/Processes/Headwaiter|logging in on the headwaiter]]. Also sent with the response is the date (presumably the one at the time the response was sent) and corresponding time zone, and <code>wtv-boot-url</code> and <code>wtv-visit</code> headers that both point to the URL <code>wtv-head-waiter:/login?</code>. The presence of <code>wtv-boot-url</code> is assumed to configure the client to connect directly to headwaiter when it boots up.

== Diagram ==
[[File:wtv1800-diagram.png|850x850px|Diagram of first-time connection]]

== Notes ==
It has been observed on real hardware that once this TellyScript is initially downloaded, it'll dial in to the numbers configured in it and then contact the headwaiter if any dialing attempts are successful.

WTVP/Processes/First-Time Registration - Revision history

Wtv-411: /* Starting the Pre-Registration Process */ Add toll-free number used for US production clients

imported>Admin at 02:35, 1 June 2021