-
Notifications
You must be signed in to change notification settings - Fork 0
System
The MSN TV 2 is a Windows CE based device, running a specialized browser with a set of proprietary MSN TV ActiveX controls on top of Windows CE 4.2 (later 5.0).
The firmware consists of an NK.BIN file that the firmware is loaded from, and a BOOT.SIG file (signature?)
MSN TV 2 firmware loads a default list of registry keys from an XIP file named default.fdf. This file uses the registry format for Windows CE 4.x to store the registry data, and includes configuration for the MSN TV application, browser settings, driver settings, and ActiveX controls, to name a few. More information on this format can be found here: https://itsme.home.xs4all.nl/projects/xda/wince-coldboot.html
The configuration for TVShell (the MSN TV browser) is located in registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MSNTV\TVShell. It contains a ConfigURL value that points to the local MSN TV file msntv:/Shell/Config.html, which is loaded by the browser when it starts up from a cold boot.
default.fdf also includes registry configuration to only allow execution of trusted MSN TV ActiveX controls from help.msn.com or any *.trusted.msntv.msn.com domain (Anduril service) over HTTPS
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\msn.com]
"Default"=""
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\msn.com\help]
"https"=dword:00000002
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\msn.com\*.trusted.msntv]
"https"=dword:00000002
MSN TV 2's browser caches assets loaded by Anduril service pages. In particular, it caches JavaScript files, HTML components, CSS stylesheets, and images loaded by these pages. The browser does not seem to cache any other formats (i.e., Flash) or service pages themselves.
Cached service page assets are stored on the second partition of the MSN TV 2's CompactFlash in the CACHE folder. The folder also stores two files named INDEX.key and INDEX.dat. INDEX.dat is a text file that maps the files in the cache folder to the URL it was retrieved from. It is unknown how INDEX.key works at the moment.