Teardown of a top-set TV box

Some years ago I signed on Elisa's (local internet/mobile provider) "Viihde" ("Entertainment") service. Original (only) reason for signing up was ADSL (originally 20/1M) but it also includes Tivo-like functionality (by connecting to their servers, you are given about 4TB of (virtual) space for recordings) and on-demand movie rental (also in 1080p) by using their custom top-set box. Total is about 40€/month, not bad (rentals on top of that, if used).

When I signed on I still had my old Topfield box which was quite sufficient, but it finally broke (actually it became unreliable - HD wouldn't wake up sometimes. I still have it but don't really know what to do with it, aside throwing it away - I did examine it but couldn't find the culprit for problems) so I moved on using Elisa's box and was actually quite surprised. I didn't suck - not too much at least.

Unfortunately the TV reception of the original box had grows progressively worse over the time, so I had it replaced with newer model. No need to return the old one so of course I had to take the old one apart to see what's inside. Unfortunately it was pretty much what I expected - system-on-chip solution with minimal external parts.

Here's the board (warning, large image).

The main processor is as expected, "SMP8635LF Secure Media Processor". I couldn't find a datasheet with quick search so I'd expect it to be under NDA. No matter, it isn't too difficult to guess that it contains relatively secure boot loader and loading (possibly encrypted) software from external flash (chip below it, sticker on top) and possibly also encryption of external memory contents (four chips up and right from it). Most likely some tampering detection thrown in for good measure. From system design perspective the datasheet might provide interesting read though.

Lower left corner (highlighted in red) is a bit more interesting. Larger chip is STM32F family MCU , but smaller one is NRF24L01 - "Ultra low power 2.4GHz RF Transceiver". This is not WLAN chip, it can only transmit relatively small data frames, so my guess would be an RF remote control or possibly programming the customer-specific parameters to the unit (each unit is tied to your account and since my account is now moved to new unit, this one will only report error when trying to connect to server). Provided remote was typical IR-based one so if they had RF capability it wasn't used. Pity, I'd love to hide this kind of units that don't need physical access behind TV or other such place where it wouldn't take real estate from units that need to be accessible (like DVD player).

The smaller red square highlight another mildly interesting part of the board. This actually appears to be USB connector. Since this is not available from outside and traces go directly to the main processor, this might be the production programming interface (there is distinctly JTAG-looking header on the bottom of the board, though)

The USB connector right from there is accessible from outside, but it can only be used for time shifting live TV (as in pausing program). There is another USB connector at back of the board too. I think I never used either of those.

On the other (bottom) side there is usual load of passives (resistors and bypass caps for chips), and a card reader module with interface chip. The is also a card interface, accessible through a slot in bottom of the (fully assembled) unit. Box has ability to subscribe to paid channels through your account IPTV so it doesn't really need card, but still it could be useful for accessing usual OTA channels, say, if your fried brings his card over.

Empty footprints at left from the processor and empty connectors look interesting too. Possibly SATA interface for optional internal hard drive? (and other large empty place - PATA connector? I don't  recognize any of those footprint patterns definitely so these are just educated guesses)

At the upper part there are connectors. TV in and out (with associated RF stuff, here with can cover removed), HDMI, another video connector (looks kinda like S-Video but has 9 pins, some non-standard connector?), headphone, optical out, another USB, Ethernet and power, each with their associated interface electronics. And on right power supplies (chip in middle has markings "Summit 113 1085LA1033" - again quick search finds nothing, but my guess is some kind power management controller).

So, all in all, this is another demonstration of current trend of electronics design. Single-purpose unit with any ability to hack or repair it very carefully removed (granted, I kinda understand it in this case, being able to receive and show HD content over internet). But that seems to be the direction we're going now. Doesn't mean that I have to be happy about it though.