LodgeNet Reverse Engineering

Many hotels (at least in the USA) equip their room TVs with a “LodgeNet” entertainment system. The TV will show regular free television channels, but also have an interactive channel controlled by the remote that features video on demand and video games.

The setup consists of a regular TV, a set-top-box and a Nintendo 64 controller.

If you play with the system a bit, it’s be quite easy to reverse engineer the architecture:

All TVs in the hotel are connected to the same internal TV cable. The cable carries one channel per room, and the TV is locked to that channel. This gives the TV a point-to-point channel to a multiplexer in the server room.

This analog multiplexer has the free-to-air channels as inputs as well as “channel 00”, which is the entertainment system. Another multiplexer switches channel 00 between the “welcome” screen and one of the servers. It is the servers that provide the image as soon as the user browses through the menu or selects video on demand or a game.

The remote is custom. The volume buttons will control the TV directly, and all other buttons are sent to the set-top-box.

The Nintendo 64 controller has extra buttons and a custom (RJ) connector.

The set-top-box has an IR receiver at the front, and sits on the cable between the multiplexer in the server room and the TV (“CABLE IN”, “TV”), in order to be able to send the commands from the remote. “DATA” connects to the Nintendo 64 controller. It is unknown what “IR” and “MTI” would be for.

If you switch channels, the set-top-box tunnels the command to the multiplexer. The on-screen-display is generated by the multiplexer. Channel “00” is the entertainment system, which by default is connected to the “welcome” channel, a series of static screens that are hotel-global.

The volume button on the remote targets the TV directly. You can tell that the on-screen-display is generated by the TV and not the multiplexer.

Switching channels with the buttons on the TV itself does not succeed. Otherwise you could watch your neighbor’s channel.

If you press the MENU key, the second-level multiplexer will switch you away from the global “welcome” channel and connect you to one of the servers. Since most hotel guests do not use the entertainment system most of the time, the number of servers is only a fraction of the number of rooms. While the multiplexer is finding a free server, it displays a “Please Wait” picture for about a second.

The user is connected to the server that is now dedicated to his TV. Key presses on the remote (except volume and channel) will be sent to the server.

A very obvious attack on the system would be to connect the cable to a TV receiver that allows switching channels.

Does anyone know more about this system? How are the games done – emulation or dedicated N64 hardware? Are the movies streamed from disk? Is there a dedicated storage server? How is the system updated with new movies? What operating system are the servers running?

13 thoughts on “LodgeNet Reverse Engineering

  1. neko68k

    the lodgenet at my property has gamecube instead of n64. also instead of a STB they have custom tuner cards installed directly in the tv that are tied by a serial number or hardware address to the lodgenet system. if a card dies and is replaced, the new card will have to be registered and the old one unregistered.

    the system is connected to the internet on a dedicated connection. updates to content are pushed through this interface. lodgenet techs are also able to remote login to the system for troubleshooting. there is also a thin client frontend for the property to use for their own troubleshooting. we can check room interface communication strength among other things.

    the property front end looks and feels like a web site. there is also an interface from the lodgenet system to the property management system that allows lodgenet to submit the room charges to the PMS. the in room interface does not function if a guest isn’t checked in to the room.

    if i can find my camera i’ll take some pics.

  2. taylor

    lodgenet updates there movies monthly depending if new movies come out in theaters or on dvd. Lodgenet some how is able to put movies in theaters on there systems. And the nintendo games are are loaded on onto there system and all the servers within the hotel . In order to play these games you need a controler with a data jack at the end of the cord . The cord is very similar to to a corded phon cord. Not all hotels have a set-top-box like specified in the photos of the system some of the old versions of the system have set-top-boxes the version of the system today does not need a set-top they have all the required jacks on the back of th tv. And not all the hotels have a menu looking welcome screen. The sheraton anheim hotel has movie promos with a menu button icon at the bottom left hand corner of the screen and once in a while theres a a menu looking promo with a yellow backround promo that comes up and the announcer says you get hit movies right here in your room press menu now and see whats new. Hope that answers your question

  3. Taylor

    The thing that is weird is that I tryied to order a movie when I first checked into the hotel and the pay-per-view menu did not work the tv only said feature unavailable and at 4 am the menu said pleas wait while we creat a varriety of entertainment choice for you and it sat there for about an hour than I gave up then at 1 pm it had the message again and then I finnaly got the menu. The menu was custom and it had the sheraton s logo faded in the backround. This is the hotel that dosent have the welcome screen they were movie promos but I figured it out it was a duplicate of channel 1 wich was movie promo also. It was probobly a system mishap becaus the system would mess up and have a weird test pattern that had the lodgenet logo on the screen with a blue backround on ch:00, 01 and it did’nt have any sound it would shut off and turn back on and it would show the same part of the promo right before the test pattern over and over again it was like a brocken reccord it would say press menu now and see whats new and then the test pattern press menu now and see whats new then the test pattern. It appeared as if the system was in a loop then after that there was plain black and white noisy static then in the morning it was fixed. I’m going back to that hotel on july 4 and hope the system is still not messed up. It was’nt my room becaus I switched rooms becaus I got a smoking room instead of a non-smoking room. I switched from 3145 to 2171 (the hotel only has 3 floors and for some reason that have four digit room numbers)

  4. Houston

    The pictures in this site are a very old version of Lodgenet VOD, calls Oasis, The second version calls River and the newest calls Marina; In Marina for example there are two servers, Host and DCS. The movies files are in DCS Hard drives (ten 250Gb HD). Host has the others material and the sistem software base on UNIX.
    more info very soon

  5. OisĂ­n

    The four digit room numbers might be a three digit number prefixed with the floor number – in your examples 3 and 2, which seems plausible if you moved from a 3rd to a 2nd storey room. Although the room number being higher on a lower floor would be odd. Still better than a number which gives no hint at its location…

  6. Zach

    For as much interest as the LNET system seems to always generate online, it never ceases to amaze me how wrong some of the assumptions people make are 🙂

  7. sg

    does anyone know the dimension of the remote control(height, width, length)? can someone measure one for me? 🙂 thanks

  8. David McDonough

    Does anyone know if these tvs can be used outside of the Lodgenet environment? We have access to a lot of them, but I cannot find an adapter that would connect a coax cable to the plug on the sets. Looks like an adapter plate was removed to give access to the box where the plug fits into the set (inside the case)

    Assuming I do find an adapter, can these sets translate a standard cable signal? Do the sets work without the remote control?

    Any help is greatly appreciated.

  9. lnet tech

    I work for Lodgenet. It is too bad you all want to circumvent the system. We don’t appreciate pirates. That is why our systems are set up the way they are. We don’t give away movies for free just as Blockbuster, or Red Box wouldn’t.

    If you want to enjoy the benefits of watching movies still in theaters in your room then pay for it.

    Thank you for your time…

  10. Nix

    “lnet tech”, you might want to look at this site more closely. The people here are interested in learning everything possible about all sorts of systems, for the sheer pure joy of it. We’re a hive of retrocomputing enthusiasts and geeks, not copyright violators. (Unless, that is, you think that knowledge of the 6502’s internals or the Apple Lisa are of great utility for software piracy. Hint: they’re not.)

    The best thing I can think of to say about copyright violation is that it is deadly boring. Why waste a general computing device on *that* when there are so very many more interesting things you can do with it?

  11. Seth

    First. David M. Yes you can use the TV’s on regular cable or with cable boxes however, you have to buy a “Tuner Card” for the tv but must be specific to that TV Type. Downside, the card is almost as expensive as buying a new TV.

    Second. Thread Poster, The “game system” is a Licensed Emulator. All content is stored on a file server, typically there is a 10% – 30% ratio of what you are calling servers. Basically they are servers but not in the traditonal sense of the word. Hardware based video cards that access data from a single data server. The data or content is uploaded from the central office to the file server via the Lodgenet satalite “net”(Local Network). There is no public access to this system. Most of the systems do use Unix, but one here is indianapolis uses BeOS. ALSO, newer systems are controlled right at the TV meaning standard programing comes through on its respective channel but the menu works on a set of channels. EX. ch 100 is the menu or pressing menu will take you to ch 100, then when you make your selection the system will issue you a channel for your stream and the tv automatically tunes to it… so with this setup if someone in the hotel is watching PPV girls gone wild and the system gave ch 119 for this stream, you to can watch that stream however only there TV (with originating serial num) can control FF/RW/Pause/Play. when the stream is closed the channel is black and displayes its channel num. With this setup, the tv is communicating with the file server and only uses the Streaming Cards to translate the Content to a format the tv can use. The system downloading new content will lock out most of the On-Demand/PPV untill the system is done with updates. Also the Front Desk has a system that communicates with the server & TV’s NEW is a web format but some that are about 10-15 yrs old is a All-In-One pc like u use to see at auto zone that runs directly off of the server. The old setup alows you to check out a guest and nothing that costs money can be purchased without calling desk. When checked in there is a dollar limit or Dep where if it were set at 9.00 and they try ordering a 12.00 movie it will display a message saying there is not enough credit for this selection and to call the front desk. Ideally to prevent lots of adjustments you should keep all rooms set to a $0 Dep so they cannot say that they didnt mean to order it they were just checking to see what was offered… a nice part of that is System will tell the front desk if a movie or show was watched for 1 minute or 30 minutes. general rule of thumb in hotels is no adjustments u push the button u bought it, some will adjust it if shows under 3 minutes and we cancel the movie from there room… Other will say there kid ordered it without there knoledge. There is also an option to set a pin number to prevent accidental or unotherized ordering.

  12. Stephen

    This article might be of interest: http://www.wired.com/politics/security/news/2005/07/68370

    I think Lodgenet broadcasts the movies from the central head-in unit, and uses channel numbers that are disabled on the remote from accessing, and if you pay it tunes it to those channels. The reason one of the posters got an “movie not available” message is the VCR or DVD player that controls that “film for rent” was in use at the time. As for the games, I am not sure if the game hardware is in the central head-in, or if the game is downloaded to the unit in each room when played.


Leave a Reply

Your email address will not be published. Required fields are marked *