MSN TV 2

Picture of MSN TV 2 unit with included keyboard and remote

MSN TV 2 (stylized msntv 2) was the last major upgrade to the WebTV/MSN TV line of products. It was announced to be in the works by Microsoft around mid 2004, when it was codenamed the "Deuce". It was officially released October 2004, with a price tag of $199.95 for the product itself, and $21.95/mo or $199.95/yr for MSN TV access through dial-up ($9.95/mo or $99.95/yr for those wanting to use the broadband plan). Its main selling points were broadband support and media streaming capabilities, the latter being a far cry from the original WebTV product's focus on internet access through the television.

The MSN TV 2 is essentially a budget PC in set-top box form. The unit now runs on x86 as opposed to MIPS like with first-gen WebTV/MSN TV units, utilizing a 733 MHz Intel Celeron processor. Storage resides on a removable 64 MB CompactFlash card in the unit, where it will boot the OS from, and MSN TV 2 units now have 128 MB of RAM, a massive improvement from the previous generation of boxes. Firmware is based off of a custom version of Windows CE with the browser being a custom-built version of IE6 made for TV displays. The unit itself has both a telephone and Ethernet jack for dial-up and broadband capabilities respectively, composite video and S-Video outputs, and two USB ports for compatible USB devices. Among those compatible devices are select wireless Ethernet (Wi-Fi) adapters, memory card readers, and while unknown to most and not covered on the official MSN TV site, external keyboard and mice, making the MSN TV 2 the first (and only) WebTV/MSN TV device to have support for mice at all. The MSN TV 2's specs is comparable to that of an original Xbox, but with twice more RAM, no dedicated GPU or audio processing, and way less storage. Coincidentally enough, many of the original WebTV/MSN TV team members later went to work on the Xbox 360 with Microsoft's Xbox division.

Features

MSN TV 2 functionality-wise is similar to the first generation of WebTV/MSN TV units. You use the keyboard and remote/mouse to navigate and supply input to pages. This time around, though, MSN TV 2 now ditches the concept of an on-screen keyboard, essentially requiring the user to use the physical keyboard for text input. The unit still requires you to sign up for the MSN TV service to be able to use it in any capacity. This service on the MSN TV 2 is similar to and loosely connected to the original MSN TV service, but overall is very different in looks and capabilities. The services offered by this service isn't all too different though, offering things such as e-mail, instant messaging, discussion groups, info centers, and more.

Since the MSN TV 2 utilizes more powerful hardware and software compared to its predecessors, it introduced many improvements and new features, which include but aren't limited to:

• A built-in media player that supports audio/video playback and streaming (streaming capabilities were limited to broadband usage)
• Better support for websites
• Improved user interface
• Support for most USB 2.0 devices
• Photo viewing

Photo, video, and music playback can also be used while offline, but those require the box to have already been subscribed and logged in to the MSN TV service.

It's known that the MSN TV 2 ported over some features originally introduced in the first generation WebTV/MSN TV products, including the original MIDI engine and the ability to play background music as you surfed. What songs were offered by the service for the latter feature is currently unknown. E-mail us by using the link on this wiki's sidebar to get in touch with us if you have any information on this.

Second-Hand Availability of Hardware

Starting in the mid 2000s, it appears that at one point in time, almost everyone and their grandma could buy an MSN TV 2 unit second-hand from any auction site, such as eBay, for cheap. The reason for them being sold for cheap at the time isn't exactly easy to guess, but with the discovery of being able to hack the units into cheap Linux boxes, it helped make the cost of performing it quite affordable. Nowadays however, it appears as if MSN TV 2 units are simply more rare to find, with 1 or 2 new listings popping up once in a blue moon on eBay at least. Some can go for ridiculous prices, though, with one listing in particular for a boxed unit being observed at a price of around $50. The cheapest you'll be able to get as of writing are listings for units starting around $20-$25 on eBay, but anyone can potentially find them on other auction sites or in actual shops such as thrift stores.

Hacking

When the MSN TV 2 came out, that seems to have marked the start of the WebTV/MSN TV hacking scene's disbanding. It appears as if most scene hackers simply lost interest and left long before the MSN TV 2's introduction, but some such as MattMan simply did not like the MSN TV 2 and felt that it was the "end of an era". WebTV scene member zefie seems to have been the only person to ever do any sort of hacking with the MSN TV 2 service and hardware. His contributions include extracting the system sounds and some of the HTML and scripts used for system functionality, and exploiting the MSN TV 2 ActiveX controls on remote web pages. What remains of these endeavors has been archived on zefie's archive site, but beware, on the particular site this is currently hosted on, without an ad blocker you'll get rammed with ads when browsing the directory and trying to access files: https://archive.midnightchannel.net/zefie/files/msntv2/.

Other than that, the most the MSN TV 2 got in terms of hacks was being able to run Linux on it, which is a feat in itself, although methods to do this as of writing involve files you can't easily get anymore, and they may not work with more modern versions of the Linux kernel.

Technical

CompactFlash

The CompactFlash card used for storage by MSN TV 2 units is FAT16-formatted and usually has 3 partitions present. The first partition is used exclusively to store the NK.BIN firmware and files used during the boot process. The second partition stores the browser cache, crash logs, and has an "updates" folder for some reason. The third partition stores all system and user configuration.

Layout: MSNTV 2/System/CF Partition Layout

CompressFS

The NK.BIN image on the first CompactFlash partition stores CompressFS partitions "web" and "SYS" past the normal Windows CE image data. The "web" partition stores all HTML, images, scripts, sound, and other media used for the MSN TV 2's user interface. "SYS" appears to store drivers and various other DLLs used by MSN TV 2.

Behavior of Factory Units

When an MSN TV 2 unit is powered on and it is still in a factory state (hasn't been connected to the MSN TV service at all), it will ask that the user connect to the MSN TV service to download the latest firmware update in order for the unit to be usable in any capacity.

 

This renders any factory unit useless unless it is able to download firmware onto itself. Since the official MSN TV service has been discontinued for almost a decade by now and there is no information or data regarding firmware updates on the MSN TV 2, flashing firmware through normal means is almost impossible. For the sake of preservation, we're interested in obtaining backups of the downloadable firmware updates and information on how MSN TV 2 updates were downloaded. Check out the Wanted link on this wiki's sidebar for more information.

SSL Compatibility

MSN TV 2 supports SSL without having to connect to servers to download root certificates like first-gen WebTV/MSN TV is speculated to. So far the certificate stores are assumed to be in the NK.BIN boot image stored on the CompactFlash card as XIP files "msntvcerts.p7b" and "sysroots.p7b", which contain several root certificates from Microsoft and other vendors. Depending on the firmware version your MSN TV 2 box is running, it'll either use SSLv3 or TLSv1 to perform HTTPS requests. It is known firmware version 4.2.5128 supports SSLv3 exclusively, and version 5.6.7021 supports TLSv1.

Known Releases

This section covers all known releases of firmware and service revisions that we are able to catalogue. This by no means is an iron clad list of all firmware/service releases nor is all the information on them complete. If you have information pertaining to either firmware or service releases that we don't have listed here, then please send it over to us!

Firmware Releases

• Firmware Version 1.0 (Build 3013) - Released October 20, 2004. First known release of the MSN TV 2 firmware.
  • Dial-up and broadband connection to the MSN TV 2 service
  • Photos (via email and USB flash card reader or storage device)
  • Printing via USB printer

• Firmware Version 1.1 (Build 5007) - Release date unknown.
  • Added support for wireless internet via select USB wireless adapters
  • Introduced home networking features (media sharing between the MSN TV 2 and compatible PCs)

• Firmware Version 1.1.1 (Build 5128) - Release date unknown.
  • Added support for USB wireless 802.11g adapters
  • Added support for additional Epson printers

• Firmware Version 1.1.3 (Build 5128.4) - Release date unknown.
  • Added Cut/Copy/Paste capabilities
  • Added support for uploading images to certain sites (namely, eBay and Epson, apparently)
  • Favorites are now sorted in alphabetical order

• Firmware Version 1.2 (Build 6214) - Released August 2, 2005. The underlying OS for this update was upgraded from Windows CE.net 4.2 to Windows CE 5.0 [1], and it introduced many improvements in the UX, networking, and CCP (Cut/Copy/Paste) capabilities. For more information: RELEASE 1.2 (BUILD 6214).

• Firmware Version 1.3 (Build 6341) - Assumed to be released around Winter 2005. Introduced stability fixes, improvements, and adds new features.
  • Ability to save images from a page to your photo album (CTRL+W) has been added
  • Flash Player upgraded from version 6 to 7
  • Favorites are now roaming, residing on MSN TV accounts. As a result, favorites can now also be accessed and managed through MSN/Windows Live on any internet-capable device
  • Ability to print pages in frames has been added
  • "Go To" panel now has a "Show Current" button
  • "Jump to Bottom" shortcut added (CTRL+PgDn)
  • Fixed connectivity bugs
  • Improved navigation in Favorites
  • Fixed crashes and improved stability with browsing eBay

• Firmware Version 2.1.359.14 Beta (Build ????) - Released September 19, 2006. This release mainly fixed bugs relating to Mail services.
  • Fixed navigation errors when trying to access Mail
  • Mail light fixed
  • Check for mail fixed

• Firmware Version 5.0.6613.103/2.1.359.16 Beta (Build ????) - Released September 26, 2006. Also a release made solely to fix bugs, specifically a crashing bug that affected Favorites, Messenger, and web surfing.

• Firmware Version 4.2.5128.0 (Build ????) - Release date unknown, but has a build date of November 30, 2004. No changes known for this release.

• Firmware Version 5.5.6189.0 (Build ????) - Speculated to start rolling out to users around early 2007. Introduced mostly ancillary changes or changes within offered MSN TV services, but also introduced improvements with memory management.
  • The MSN TV Radio service has been overhauled to introduce more options for radio stations and music styles, and radio stations can now be saved to your Favorites as a part of this update ("MSN Stations" and "My Stations" have been removed as a result of these changes)
  • "Share Photos" feature - allows MSN TV subscribers to share photos from their device to friends with a Windows Live Space (Spaces are public by default, although the visibility can be changed when creating it)
  • Large audio and video files can now be played back
  • If Flash content on a web page is possibly taking up more memory than the MSN TV 2 unit can allow, an alert will be displayed to the user stating that the content can't be played due to memory limitations (Before this update, content that drained the unit's memory would cause it to crash)
  • Photos on the MSNTV 2 unit can now be submitted for professional printing through approved vendors (Shutterfly, Fuji, etc.)

• Firmware Version 5.6.7021.0 (Build ????) - Release date unknown, but has a build date of July 24, 2009, and is probably the last production build to be released before the MSN TV service shut down on September 30, 2013. Not many changes have been recorded for this release, but it's been observed that when browsing between pages using this firmware version, a fade-in transition is used to show the next page, similar to how the first-generation WebTV/MSN TV browser transitioned between pages.

Service Releases

• Service Release 1.1.2 - Release date unknown. Added spell check for e-mail and the ability to migrate favorites from accounts on the first-gen WebTV/MSN TV service.

Service

Not much is known about the underlying service MSN TV 2 used at the moment. From what we've been told, the MSN TV 2 service ran on IIS servers, with HTTP/HTTPS requests being performed between the service and boxes, and XML being used when necessary.

Starting in 2023, attempts have been made to document and archive the MSN TV 2 service more extensively outside of this wiki, including how login works. Currently, the only place documenting the MSN TV 2 service at this level is a wiki hosted on GitHub. There is also a GitHub repository available that hosts service content from the MSN TV 2 service salvaged from a few sources online and used MSN TV 2 boxes, which can be found here.

First-Time Registration

On unregistered boxes, the MSN TV 2 will attempt to send a GET request over HTTPS to the web address https://headwaiter.trusted.msntv.msn.com/connection/kickstart.aspx when starting to register for the MSN TV service. From the domain name we can assume the URL has a function similar to the first-generation WebTV/MSN TV headwaiter, which handled login requests from boxes. The request sent to this URL from an MSN TV 2 unit does not contain any special headers or HTTP body data. The kickstart.aspx service is also used for login, and while the original behavior of this service when used during registration is unknown, it's believed that the service would have checked if the box had a subscription attached to it before deciding to take it to the registration pages.

"SG" Servers

The core MSN TV 2 services were hosted on web servers, with their domain names taking on the format of either "sgX.trusted.msntv.msn.com" or "sgX.msntv.msn.com", X being a number from 1 to 4. This wiki will refer to these services as "SG" servers. Our best guess for what "SG" stands for is "service gateway", as these servers are assumed to offer core MSN TV 2 services such as login, mail, and discussion groups, through normal HTTP(S) requests. The first domain name is for SG servers operating over HTTPS, and the second one for SG servers operating over plain HTTP. There are also special prefixed versions of the domains for e-mail and synchronization services, those currently known being "mail-sgX.msntv.msn.com" and "sync-sgX.trusted.msntv.msn.com".

Known Services

DISCLAIMER: The pages for the service IDs and URLs listed below are out of date, and will likely not be updated here for a while. You can find an up-to-date list of the service IDs here, and service URLs here.

• Service IDs

---

• Home Page/Centers

---

• Login
• Registration
• E-mail
• Newsgroups
• Sync
• Misc.

Image Gallery

See MSNTV 2/Services/Gallery.

Domains

Home:

• msntv.msn.com - Hosts home page, info center, and help content.

Registration:

• headwaiter.trusted.msntv.msn.com

SG:

• sg1.trusted.msntv.msn.com
• sg2.trusted.msntv.msn.com
• sg3.trusted.msntv.msn.com
• sg4.trusted.msntv.msn.com
• sg1.msntv.msn.com
• sg2.msntv.msn.com
• sg3.msntv.msn.com
• sg4.msntv.msn.com
• mail-sg1.msntv.msn.com - Mail SG server.
• mail-sg2.msntv.msn.com - Mail SG server.
• mail-sg3.msntv.msn.com - Mail SG server.
• mail-sg4.msntv.msn.com - Mail SG server.
• sync-sg1.trusted.msntv.msn.com - Sync SG server.
• sync-sg2.trusted.msntv.msn.com - Sync SG server.
• sync-sg3.trusted.msntv.msn.com - Sync SG server.
• sync-sg4.trusted.msntv.msn.com - Sync SG server.

External Links

• Mirror of a 2006 guide for installing Linux on the RM4100 MSN TV 2 (Wayback Machine)