My final post in this thread is just a heads up to let anyone who read my previous post know that I have now made significant changes to it.
I believe that my previous post is now free of significant errors and thus easier to follow.
I hope someone else finds this incredibly quick and simple de-protection method useful.
Just a note to point out that I am still looking into this.
However, I noticed on the HDR FOX-T2 CF thread this, http://hummy.tv/forum/threads/force-dlna-index-auto-decrypt-auto-shrink.5257/, relating to DLNA indexing. I have managed to create a prototype piece of software that can, from a GUI, "Foxy" one file or all files requiring it or rebuild chunked files (the 2000T has a problem if you rewind live TV and press record!). I have also managed to write a simple downloader that does tap into the DLNA and stream decrypted files to my PC. But it cannot force the 2000T to re-index the files remotely, so foxied and de-chunked files are ignored. Expecting the answer "it can't be done" - is it possible to send a DLNA command from an external device (ie. my software on a PC) to the Humax to force it to re-index? Or do I have to go back to the Humax and force an index by turning the server off and on?
I am also looking for a simple and unambiguous way to differentiate between "Enc" (Foxy- 0x03dc), and encrypted/decrypted (whether a programme really is decrypted and can be copied by ftp - bit 0 of 0x028e). Why? I want to be able to toggle the encrypt/decrypt flag in the .hmt file just in case I load the decrypted file back to the Humax. A simple form of words to be placed on a toggle button to refer to the flag at 0x028e is what I'm looking for. Any short suggestions? Humax's use of the Enc flag to mean "can't be decrypted" makes the terms encrypt & decrypt confusing to some people, especially when every file is initially encrypted.