A Better mtv frontend

mtv communicates with mtvp via a pair of pipes, and a proprietary protocol. This protocol can be used to create an interface without the problems that mtvcontrol suffers from.

I don't have an interface yet, but I've got almost enough of the protocol sufficiently reverse-engineered that I can soon implement an interface. I still need to figure out some of the window-based commands. Not sure how soon I'll have time though.

How mtv works with mtvp

when the MpegTV's interface program (mtv) starts, it first makes two pipes, which end up with the file descriptors 3,4 and 5,6. mtv then starts mtvp with the option -r3,4,5,6 which tells it about these file descriptors (mtvp will inherit them from mtv). mtv then closes descriptors 3 and 6. It writes to fd 4 in order to send messages from mtvp, and reads from fd 5 to receive messages. Likewise, mtvp writes to fd 6 and reads from fd 3.

The protocol used to communicate is based on packets with the following format:

    +------------+--------------+---------+--------------------+------------+
    | sequence # | command type | command | size of parameters | parameters |
    | 2 bytes    | 2 bytes      | 2 bytes | 2 bytes            | (variable) |
    +------------+--------------+---------+--------------------+------------+

Each direction maintains its own sequence numbers, starting at zero.

The following command types have been identified:

0x0000 - commands with arbitrarily defined parameters
0x0002 - commands which use no parameters
0x0004 - commands which use an integer parameter
0x0006 - commands which use a double parameter
0x0036 - commands which use a double parameter, and want an ACK of the request
0x0038 - the command used to send the filename (and request an ACK packet)

The following is a list of commands. Each direction has its own command set; while they hardly overlap, they do slightly. In some cases the overlapping command code means the same thing in both directions, in other cases it doesn't. The only place where the combined type and command overlap is type 0x02 command 0x0a.

Commands from mtv to mtvp

Type Command purpose parameters

0x02 0x02 exit -

0x04 0x08 set pause/play state: 2 == play, 1 == pause, 0==stopped or done?, 0x8000000x used when scrolling

0x02 0x09 step to next frame -

0x02 0x0a jump to end of program ??? -

0x04 0x0b jump to random location in file byte offset (from beginning of file)

0x04 0x0c set looping 0==off, 1==on

0x04 0x10 set auto play 0==off, 1==on

0x04 0x11 set display mode 0==no display, 1==gray, 2==8bit, 3==truecolor

0x36 0x12 gamma correction 1.4 is default for suns

0x04 0x13 set frame mode 0==maintain nominal frame rate, 1==all frames, 2==I&P frames, 3==Iframes

0x06 0x14 set frame rate 0==use encoded framerate from file; 29.97 is most common

0x04 0x15 mute 1==mute, 0==unmute

0x04 0x16 set audio channels 0==both, 1==left, 2==right

0x04 0x17 set audio quality 0==low, 1==medium, 2==high

0x06 0x18 set volume 0.0 to 1.0 (loudest)

0x06 0x19 set balance 0.0 (left) to 1.0 (right)

0x04 0x1a use pcm vol/bal???: ?

0x02 0x25 where are you in the file? -

0x02 0x26 what is your frame rate? -

0x02 0x27 what is your current frame? -

0x36 0x29 contrast 0.0==normal

0x36 0x2a brightness 0.0==normal

0x04 0x2c set audio output bitmask: for suns, has these values: 0x04==line-out, 0x02==headphone, 0x01=speaker

0x00 0x35 security key 4 byte key

0x04 0x41 set aspect ratio 0==square, 1==from file, 2==unconstrained

0x36 0x43 saturation 1.0==normal

0x38 0x47 set file null-terminated filename

0x00 0x4e X11-related request see "Extended Commands" below

Commands from mtvp to mtv

0x04 0x01 unidentified, at startup only observed value has been 0x0a

0x00 0x02 ACK??? followed by the actuall packet being ACKed, including sequence number, and then 4 more unidentified bytes

0x02 0x04 unidentified, at startup -

0x02 0x05 unidentified, at exit -

0x04 0x06 my pause/play state is same as 0x02 0x08, above

0x04 0x07 i've read this many bytes bytecount

0x06 0x08 my frame rate is framerate

0x04 0x09 i'm on frame number frame number

0x02 0x0a unidentified, sent after filename received. note that this is "jump to end of program" command when sent in the other direction -

0x02 0x0b unidentified, at exit -

0x06 0x0d my volume is 0.0 to 1.0

0x06 0x0e my current balance is 0.0 to 1.0

0x04 0x12 the file size is size of file in bytes

0x02 0x15 unidentified, response -

0x00 0x17 video information see "Extended Commands" below

0x00 0x18 audio information see "Extended Commands" below

0x00 0x19 freeze frame info (sent whenever frame is frozen for any reason, e.g. pause, end, slider in use) see "Extended Commands" below

0x00 0x1a combined data (audio, video, overhead) bits/second. i.e. seconds of playback can be calculated by (8*filesize/this number) integer - number of bits

0x04 0x1b unidentified, response to something - maybe means "end transaction" or something like that? 4 bytes of data, observed value always 0x0100

0x04 0x1c audio out can be ??? see 0x04 0x2c above

0x04 0x1d my audio output is set to see 0x04 0x2c above

0x02 0x1e unidentified, after EOF -

0x02 0x1f unidentified, after EOF -

0x04 0x20 unidentified, at startup value changes with each run, samples: 0b45, 055e, 09ad, 09fa

0x02 0x22 unidentified, at startup -

0x00 0x23 unidentified, at startup 4 bytes of data, observed value of zero

Commands from mtv to mtvp
Type	Command	purpose	parameters
0x02	0x02	exit	-
0x04	0x08	set pause/play state:	2 == play, 1 == pause, 0==stopped or done?, 0x8000000x used when scrolling
0x02	0x09	step to next frame	-
0x02	0x0a	jump to end of program ???	-
0x04	0x0b	jump to random location in file	byte offset (from beginning of file)
0x04	0x0c	set looping	0==off, 1==on
0x04	0x10	set auto play	0==off, 1==on
0x04	0x11	set display mode	0==no display, 1==gray, 2==8bit, 3==truecolor
0x36	0x12	gamma correction	1.4 is default for suns
0x04	0x13	set frame mode	0==maintain nominal frame rate, 1==all frames, 2==I&P frames, 3==Iframes
0x06	0x14	set frame rate	0==use encoded framerate from file; 29.97 is most common
0x04	0x15	mute	1==mute, 0==unmute
0x04	0x16	set audio channels	0==both, 1==left, 2==right
0x04	0x17	set audio quality	0==low, 1==medium, 2==high
0x06	0x18	set volume	0.0 to 1.0 (loudest)
0x06	0x19	set balance	0.0 (left) to 1.0 (right)
0x04	0x1a	use pcm vol/bal???:	?
0x02	0x25	where are you in the file?	-
0x02	0x26	what is your frame rate?	-
0x02	0x27	what is your current frame?	-
0x36	0x29	contrast	0.0==normal
0x36	0x2a	brightness	0.0==normal
0x04	0x2c	set audio output	bitmask: for suns, has these values: 0x04==line-out, 0x02==headphone, 0x01=speaker
0x00	0x35	security key	4 byte key
0x04	0x41	set aspect ratio	0==square, 1==from file, 2==unconstrained
0x36	0x43	saturation	1.0==normal
0x38	0x47	set file	null-terminated filename
0x00	0x4e	X11-related request	see "Extended Commands" below
Commands from mtvp to mtv
0x04	0x01	unidentified, at startup	only observed value has been 0x0a
0x00	0x02	ACK???	followed by the actuall packet being ACKed, including sequence number, and then 4 more unidentified bytes
0x02	0x04	unidentified, at startup	-
0x02	0x05	unidentified, at exit	-
0x04	0x06	my pause/play state is	same as 0x02 0x08, above
0x04	0x07	i've read this many bytes	bytecount
0x06	0x08	my frame rate is	framerate
0x04	0x09	i'm on frame number	frame number
0x02	0x0a	unidentified, sent after filename received. note that this is "jump to end of program" command when sent in the other direction	-
0x02	0x0b	unidentified, at exit	-
0x06	0x0d	my volume is	0.0 to 1.0
0x06	0x0e	my current balance is	0.0 to 1.0
0x04	0x12	the file size is	size of file in bytes
0x02	0x15	unidentified, response	-
0x00	0x17	video information	see "Extended Commands" below
0x00	0x18	audio information	see "Extended Commands" below
0x00	0x19	freeze frame info (sent whenever frame is frozen for any reason, e.g. pause, end, slider in use)	see "Extended Commands" below
0x00	0x1a	combined data (audio, video, overhead) bits/second. i.e. seconds of playback can be calculated by (8*filesize/this number)	integer - number of bits
0x04	0x1b	unidentified, response to something - maybe means "end transaction" or something like that?	4 bytes of data, observed value always 0x0100
0x04	0x1c	audio out can be ???	see 0x04 0x2c above
0x04	0x1d	my audio output is set to	see 0x04 0x2c above
0x02	0x1e	unidentified, after EOF	-
0x02	0x1f	unidentified, after EOF	-
0x04	0x20	unidentified, at startup	value changes with each run, samples: 0b45, 055e, 09ad, 09fa
0x02	0x22	unidentified, at startup	-
0x00	0x23	unidentified, at startup	4 bytes of data, observed value of zero

Extended Commands

Three commands have been observed that set multiple parameters at once, One from mtv to mtvp, and two from mtvp to mtv. The one from mtv seems to be related to X11. The command is type 0x00, command 0x4e. The size of the paramaters is 264. The first 8 bytes seem to be a subcommand: size (possibly), as the first four bytes, and then the command, which so far has been from 0 to 7. The remaining block is the data, which always seems to be 256 bytes. The subcommands seem to each have multiple functions, but this is part of what they seem to be doing:

0 - initialization???
1 - colormap,
2 - this one hasn't appeared in my tests yet
3 - layout (i.e. fill, centered, topleft),
4 - some string identifier, null padded, which is not the window title
5 - window title (the entire data block consists of the title string, null padded)
6 - window position,
7 - window size,

Unfortunately, I don't have much sketched out for the content of these data blocks.

From mtvp to mtv, there are three extended commands, one for video information (0x00 0x17) and one for audio information (0x00 0x18). They are shorter, 48 and 40 bytes of data respectively. I've mostly mapped out their meaning:

    0x00 0x17 video information, 48 bytes
    +------+------+------+------+------+------+------+------+
 0  |   00 |   00 |   00 |   01 |    width of MPEG video    |
    +------+------+------+------+------+------+------+------+
 8  |   height of MPEG video    | number of bits per second |
    +------+------+------+------+------+------+------+------+
16  |   VSV? buffer size ???    |      |      |      |      |
    +------+------+------+------+------+------+------+------+
24  |    double == frame rate                               |
    +------+------+------+------+------+------+------+------+
32  |      |      |      |      |      |      |      |      |
    +------+------+------+------+------+------+------+------+
40  |    double == pixel aspect ration                      |
    +------+------+------+------+------+------+------+------+


    0x00 0x18 audio information, 40 bytes
    +------+------+------+------+------+------+------+------+
 0  |   00 |   00 |   00 |   0? |   00 |   00 |   00 |   02 |
    +------+------+------+------+------+------+------+------+
 8  |  audio recorded bits/sec  |   00 |   00 |   00 |   00 |
    +------+------+------+------+------+------+------+------+
16  |    double == sample rate or playback rate             |
    +------+------+------+------+------+------+------+------+
24  |   00 |   00 |   00 |   00 |   00 |   00 |   00 |   0? |
    +------+------+------+------+------+------+------+------+
32  |   00 |   00 |   00 |   00 |   00 |   00 |   00 |   00 |
    +------+------+------+------+------+------+------+------+


    0x00 0x19 single frame information, 64
    +------+------+------+------+------+------+------+------+
 0  | frame type, 0=I, 1=P, 2=B |    temporal reference     |
    +------+------+------+------+------+------+------+------+
 8  |    double == VBV delay, in seconds                    |
    +------+------+------+------+------+------+------+------+
16  |   00 |   00 |   00 |   0x |   00 |   00 |   00 |   0x | forward f-code?
    +------+------+------+------+------+------+------+------+
24  |   00 |   00 |   00 |   01 |   00 |   00 |   00 |   01 | backward f-code?
    +------+------+------+------+------+------+------+------+
32  |      |      |      |      |      |      |      |      |
    +------+------+------+------+------+------+------+------+
40  | frames played to this pnt |      |      |      |      |
    +------+------+------+------+------+------+------+------+
48  |   00 |   01 |   00 |   00 |   00 |   00 |   00 |   00 |
    +------+------+------+------+------+------+------+------+
56  |    double == seconds into content where this frame is |
    +------+------+------+------+------+------+------+------+

Reverse Engineering and the Law

I AM NOT A LAWYER However, I have studied this issue and come to the conclusion that the software and information presented here was legally develloped and derived, and can be legally distributed in the United States.

Reverse engineering is the process of figuring out how something works only by examining the final product. This information can then be used to develop competing products or add-on products. At the time of this writing (June, 2000), reverse engineering is still legal (in the United States).

On the other hand, the license that you agree to does explicitly forbid this activity. However it is unclear that such an agreement is legal. Software licenses are widely believed to be so legally flawed as to be worthless. In other words, if reverse engineering is legal, MpegTV can't make it illegal.

Of course, under strict terms of their agreement, even the original klunky interface (mtvcontrol) might be considered a violation of their license, since it is a derivative work (sort of). There was even some reverse-engineering involved in its development, since the mtvp documentation turned out to be incorrect in a couple of cases.

Fine's Home

Send Me Email