How To: Download Humax files to PC - DECRYPTED

Black Hole

May contain traces of nut
This is a revised post, incorporating discussion in the topic and more recent developments.

As the custom firmware web interface now includes a download facility (and also an in-browser play option), the following is mostly of interest to HDR-FOX users disinclined to install the custom firmware, and also HDR-1800T and HDR-2000T users (for whom there is currently no custom firmware).

It works by tapping into the DLNA server interface in the HDR-FOX (update 1.02.20 onwards). HD-FOX does not have this facility. The files have to be decrypted by the server on the way to the network stream, so by kidding the Humax into providing a network stream that can be saved at the other end, you kill two birds with one stone (decrypt AND transfer to PC in one go), bypassing the need to copy to USB drive (or virtual drive).

This applies to StDef recordings, and can also be applied to HiDef recordings after a small amount of pre-processing.

HiDef Recordings

Credit to culbin for spotting this trick, see footnotes. HiDef recordings are normally only served in a protected stream on HDR-FOX, and not at all on HDR-1800T/HDR-2000T.

Copy the .hmt file associated with the recording to a PC. This is most conveniently done via FTP (the Humax FTP server will need to be turned on in the settings), or can be done by copying the recording to a USB pen drive (with difficulty - see below). Run the Foxy program on the target .hmt file to clear the ENC flag, then copy the processed file back to the Humax (replacing the original). See HERE (click) for more information about Foxy.

Now move the target recording (with modified .hmt file) to a different folder or change the name of all the files in that set (eg add a "_" at the end). This causes its original DLNA index entry to be invalidated and a new entry created - without the restriction flag which prevented its unrestricted streaming. The recording can be moved back to its original location (or it's file names restored) afterwards if desired.

The recording can now be treated as if it were StDef, see below for instructions to download to PC. Not only that - the recording can now be streamed to a player by DLNA (HDR-2000T won't normally stream locked HiDef recordings at all, and HDR-FOX will only stream them to another Humax).

The .hmt file can be transferred to/from the PC by USB pen drive if necessary, but is not recommended. The only (non-custom) way to copy from/to the Humax to/from the UPD is to copy the entire recording, which (in the case of a HiDef recording) is likely to be several GB of data and take a long time. In the case of a recording in excess of 4GB, the UPD will need to be formatted NTFS (which rules out the non-customised HDR-FOX) or Ext2/3 (which needs an additional utility in Windows). Copying a 4GB+ recording to FAT32 will result in the recording being truncated without warning, and transferring the unlocked .hmt file back to the Humax will transfer the truncated recording file with it. The .hmt file itself is very small, and very quick to transfer (on its own) by FTP. For more information see Things Every... (click) section 12.

StDef Recordings

First, "content sharing" needs to be turned on in the Humax settings, and it will take some time to build a database of streamable media when turned on for the first time:

Menu >> Settings >> System >> Internet Setting >> Content Share = On

Then you need to know your Humax' IP address, see (depending whether your Humax is networked by cable or WiFi:

Menu >> Settings >> System >> Internet Setting >> Configure LAN

Menu >> Settings >> System >> Internet Setting >> Configure Wi-Fi

Next, you need to know the Media ID for the recording you wish to transfer. For this, use a PC program called UPnP Inspector:
A suggestion on The Other Place has eliminated the need to run XBMC at all. It's called UPnP Inspector (click here) and provides a file manager-like view into the DLNA server, where you can browse the folder structure and see the files listed - complete with URL path for the download.

Works fine. You have to right-click on the Humax and select "browse mediaserver". The properties for any particular file are displayed in the lower pane of the new pop-up, including the ability to right-click copy the download URL (it also offers to open it, but that doesn't seem to do anything - maybe it will one day).

Original post on AVForums (click)

If you are not using a PC, see comments about VLC below.

The Media ID will look something like "" (where the x's represent numbers). Typing or pasting the Media ID into a web browser will either cause the file to commence downloading (to a destination of your choice), or attempt to play it (if the .TS file extension is associated in your browser with a media player). Installing the VLC plugin for your browser should result in the recording being played.

If the browser plays or tries to play the file rather than offering to download it, you can use the browser settings to disassociate .TS from being a playable file, or alternatively use another utility instead of the browser. For this you need wget.exe (click). This is a command-line utility for Windows (similar is available for other operating systems), it only requires saving somewhere suitable and then running in a command box from that directory. The easiest would be to install it in the destination directory for your transfers.

Open a command window and use DOS commands to "cd" to the working directory (where you put wget.exe). Then at the command prompt type (replacing the parts in square brackets with your parameters):

wget http://[Humax IP address]:9000/web/media/[mediaID].TS​

Everything after the "wget" can actually be copy-and-pasted from the UPnP Inspector output. In my case: it downloaded 214MB of radio programme file in 3m15s, that's a bit over 1MB per second, and the resulting file played in VLC. The downloaded file will be called [mediaID].TS ([mediaID] being a string of digits), stored in the current directory (if you have followed the instructions above, that will be the same place as you stored wget.exe).

Credit to ratx for the initial inspiration for this.

Update: Version 2.0.1 of VLC is now able to browse and play content directly from a DLNA source, and save the stream if required (quote edited to update):
VLC has reached v.2 and the uPnP streaming capability that was previously only available in the Linux version is now also present in VLC for Windows.

1) Install VLC v2.0.1 - download here (note that later versions have difficulty accessing the HDR-FOX).
2) Run and click View - Playlist
3) On the left, select Local Network - Universal Plug'n'Play.
4) The Humax should appear in the file browser. Navigate to the file required and click!

This needs Humax media sharing to be enabled. You get full control and all the usual VLC goodies, like video and audio tweaking. On a standard setup, only SD files can be streamed, due to the restrictions built into the Humax.

Update: Apparently this can also be achieved using Windows Media Player to both access the relevant URL and save the stream. See HERE (click).

Update: Credit to culbin for spotting a trick which extends this method to apply to HiDef recordings (quote edited for accuracy):
I can confirm the 2000T does serve up HiDef content via DLNA after Foxy is used to first update the associated HMT file and the recording is moved to another folder (no additional partition required). I know this because I have two 2000T's on my home network and I stream recordings from one to the other.
StDef always works without any changes required. For HiDef this is my quickest method of unlocking.
1. Create a folder on the 2000T that will hold the HiDef recording you want to unlock.
2. Using FTP client copy the associated HMT file to a PC.
3. Using Foxy process the HMT file.
4. Using FTP cilent copy the updated HMT file back to the 2000T and overwrite the original.
5. Using the 2000T remote select the HiDef recording and move it to the new folder (this happens immediately with no waiting required).
6. The recording in the new folder is now unlocked. Move it back to the original folder if you want. This recording will now stream to another 2000T (or other DLNA device) or copy it off to a USB drive to play elsewhere.
Last edited:
Hey Blackhole thanks for writing this up - sorry if I wasn't clear in my other post - you don't really need to use wget if you're downloading it onto your PC - your web browser will do just as well. I used wget in the examples I posted because I was trying to decrypt and store the content on the Humax itself and obviously that doesn't have a web browser - only wget. If you use VLC you can tell it to use the same sort of URL and it will stream it straight off the Humax
I have now cracked the problem of identifying the mediaID without mods. By running XBMC and navigating to the Humax video files (DLNA) and then playing the file in question, the mediaID appears at the bottom of the XBMC screen.

Update: Users running the custom software can access the mediaID from the web interface - click on the file name in the media browser and an information panel pops up including the mediaID string. Right-click on that and you get the option to copy it for pasting elsewhere (eg wget command line).

Why would users of the custom software still need wget when there's a download button? Answer: I need it because my installation of Internet Explorer 8 doesn't play nicely with the download option.
you don't really need to use wget if you're downloading it onto your PC - your web browser will do just as well.
How? I tried plugging the http... etc into the address bar (IE8), it opened a message box to download but gave up trying to get a response from the other end.
It should just work - its doing the exact same thing as wget afterall - just tried it in ie8/chrome/Firefox and it works - though had to retry a couple of times in ie - do you have a proxy set up in ie8 or something?
Okay, well wget works for me, and as I can 2-click open a command window in any directory I like (DOpus) it's as good as anything else. I'm sure other people will find their own way.

Update: if the .ts file type is associated with a media player (in Windows), the browser will try to play the file instead of offering to store it. wget bypasses this.

I also tried VLC and it plays the stream (put the http...TS string into the network stream source box), plays fine (but of course I needed XBMC to identify the mediaID). I tried transcoding to mp3 and got garbage, but that might be because I don't know what I'm doing.
Okay, well wget works for me, and as I can 2-click open a command window in any directory I like (DOpus) it's as good as anything else. I'm sure other people will find their own way.

In Windows 7, hold down shift and right-click on the directory and you get the option to open a command window, no extra software needed.
Update: AF123 has just announced an update to auto-unprotect (see here) that cancels the secure streaming protocol for HiDef files (in the SQL database). This means that with the modified software running auto-unprotect, we can now stream or download all content by the standard DLNA server.

Edit: this applies to HDR-FOX only
Last edited:
I have now cracked the problem of identifying the mediaID without mods. By running XBMC and navigating to the Humax video files (DLNA) and then playing the file in question, the mediaID appears at the bottom of the XBMC screen.
Hmm... I have now lost this. I have been playing with the XBMC settings (I actually streamed Gadget Show to bed last night instead of using Demand 5) so I don't know if I have done something to upset it, but I was thinking of trying the url reference in WMC and couldn't find it. Anybody know?
I have just started looking at this method using XBMC. Took some fiddling to get a connection to the Humax, but got there in the end. I did not see any media id. Oddly the program played with subtitles and I did not see how to turn them off. I am using a Mac, so things are likely to be somewhat different from a Windows machine, but should be close enough.

I am aware of the possibility of modifications, and it looks as though that would not cause any problems, but at present I don't feel brave enough to go that route.

I am only wanting to transfer SD programs at present.
Yes, I can't figure out what happened to the media ID in XBMC - it was definitely there once and then I lost it. I will have to investigate further but I've been putting off some other chores and really have to make myself attend to those before I play. Could be a while! I think there should be a way to get the media ID by pretending to be a DLNA client interrogating the server - somehow the directories and file names displayed in the listings get translated to a media ID reference, much the same way (presumably) as the file access is initiated by a properly-constructed URL. I propose to run a network sniffer and grab the traffic while XBMC is fetching the listings, it should tell me something and then I might be able to extract the media ID directly.

As far as subtitles go, on the top toolbar when the file is playing, the speaker icon is audio and subtitle settings, within which you can turn off subtitles and save as default.

I don't get on with the default skin, but not figured out how to give it a different one yet.
Can anybody tell me the most straight-forward way to capture network traffic? I did a bit of this in my job a long time ago but I had spare PCs to play with and OSs were less restrictive too. Of course, I need my PC running XBMC so I don't want to disturb that, but if I can get hold of another PC with Ethernet is there a bootable environment that will make this easy?
Just install Wireshark on Windows or MaxOSX, or use tcpdump on the Humax or on a Linux box.

I'd recommend the Wireshark route as it has a functional GUI which makes things a lot easier.
Yeah, I've done it now. Wireshark Portable wouldn't do it without installing another driver, so I took the plunge and installed it properly and captured the traffic when XBMC was linking to the Humax and then browsing and playing a video file (just the start!). I have the capture and can inspect it with WS Portable, so have rolled the system back to get rid of the promiscuous driver.

I can't pretend to understand all I'm seeing, but I can see packets from XBMC making queries to the Humax SQL which then get replies in the form of media IDs and associated strings (which get presented as the directory listings as you click through the navigation). The next level query uses the media ID to access the next step in the directory chain until you get to the actual recording media ID.

All looks a bit complicated to simulate on a command line, but I'm sure somebody (not me!) could write a user interface which did the same thing and displayed the media IDs as well. That would give non-modders everything they need to download StDef recordings directly (the user interface program would be running on the PC, and could do the wget as well).

I can supply the network grab if anybody wants to take it on.
Ha! I'll tell you something even better: you don't have to wait for the file to finish downloading before playing it in VLC. I got 2MB/sec downloading Gadget Show tonight, and the advantage of downloading and then playing with VLC instead of just playing in XBMC is you can skip forward and back.

(Black mark to Splash Player Lite - it won't play the file until download is complete.)
OK folks, it's a bit clunky but I have a way to determine the mediaID off-the-shelf.

XBMC creates a new log file each time it is run. On my system (Win7) it is here: C:\Users\<username>\AppData\Roaming\XBMC\xbmc.log (but note that this directory is hidden away from prying eyes so you might need some persistence to find it - try searching for xbmc.log). What I have done is add a shortcut to my desktop so I can open the log any time I like no bother.

When you want to know a mediaID:

Fire up XBMC, navigate the Humax server to the recording you want, play it and stop the playback then exit XBMC.​

Open the log file (Notepad is the default), do a search for ":9000/web/media/", and the mediaID you require follows it. In fact, even better, the whole string from "http" to ".TS" is what you need to plug into wget to fetch the file - no need to check what IP address your Humax is sitting at today.​

Now, I'm thinking - it won't be that difficult to write a little batch file which takes xbmc.log as its input, automatically finds the :9000 line, and feeds it to wget all in one go... That's something I can do!
Can't see it mentioned before but to get the mediaID using XBMC you don't need to play the file just right click the recording you need the mediaID for and select 'movie information'

Aha! That's where it went (doh)! Actually, I'm sure I saw the mediaID near the bottom left just before a file plays, where a "/" comes up now before the recording length.

I've just realised I didn't give proper credit to Ratx for the idea - corrected in the first post.
I had just found the solution using the log file an hour or so ago. Right-clicking on the item is even better.

The file downloaded by wget is a bit weird, though. Plays fine in VLC. But I am used to processing files in MPEG Streamclip and would probably prefer to continue doing that. In that program, it comes up as "unrecognised file type" and if I choose to continue it takes ages to come in (minutes, not seconds) and, shows PID and length ok, but appears as a completely blank screen. I'll have to work further.