I have no idea how the developers cracked the firmware.
If Humax had intended it to be secure, they didn't do a very good job - probably not realising that enthusiasts would look for a way around their simple attempt at security. The firmware update files are only secured by a "signature" which authenticates the file before the firmware updater permits it to be installed - the actual data is a plain binary of the execution code, which can be reverse-engineered with knowledge of the processor that executes it. As Humax used open-source components in their firmware, they were obliged to publish some details of the inner workings to honour the terms on which they used the open-source components, so that provided some intelligence, and there was some physical inspection and educated guesswork (and the Internet is a wonderful source of technical information).
The understanding of the code was one thing, but it also needed a spoofed signature to make our own code loadable as a firmware update. Some knowledge of typical cryptographic signature algorithms and a bit of trial and error cracked that, so that
af123 could then both create a custom firmware image
and give it a valid signature. There was little need, at that stage, to understand how very much of the code worked - all (!) that was necessary was to enable access to the Linux command line (open source) and therefore be able to inject our own commands to run alongside the Humax proprietary code (the benefits of a multi-processing computing environment).
Humax have a responsibility to prevent users altering the product - an altered product cannot have any warranty, but more particularly may not conform to the legal requirements for putting a product on the market as was proven in laboratory tests on the product (eg CE comformity). By locking down successive products much harder, all Humax are doing is learning from their mistakes and upholding their responsibilities.
I don't think I'm giving away any secrets here, and I'm certainly not belittling the efforts of the likes of af123, Raydon, xyz321,
et al. It was straightforward (relatively!) to
add our own functionality - it is much tougher to hack into the publicly-undocumented Humax proprietary code (which handles virtually all the interaction with the tuner and video hardware as if a "black box") to tweak the way native functions work. That is what is needed, for example, to turn off recording encryption. I assume the FOXSAT was much simpler in that respect (hence Nowster's patch).
). Without access to the newer FVP range, I'm not sure there is even...
)