Ben Eater's Gosh Darn Good Job at Reverse Engineering TVGuardian's Naughty Word Filter

Wow, yeah!

James Lewis
2 months agoRetro Tech / HW101

In this fun reverse engineering video, Ben Eater answers an off-handed request from the YouTube Channel Technology Connections on what words a device called The TVGuardian censors. Eater looks over the device's relatively straightforward printed circuit board, removes a standalone EEPROM, dumps its contents, and analyzes the results.

Please note, while efforts from Ben Eater and Alec Watson (Technology Connections) were taken to obscure some of the more offensive content, the links in this story contain potentially sensitive language.

The TVGuardian monitored the closed captioning (CC) information in analog video signals from broadcast sources like television or pre-recorded sources like VHS tapes. It provided a pass-through path for both composite and RF sources. When a word in the CC stream matched its pre-programmed list, it performed several actions. First, TVGuardian mutes the audio channel and then replaces the text in the captioning data. While muting the audio, the device overlays the modified strings on-screen. This last action helped fill in potentially lost context due to muted audio.

In the Technology Connections video, Watson wonders out loud what words are on the naughty list. This challenge is where Ben Eater comes into the picture.

Ben Eater's reverse engineering of TVGuardian's naughty word EEPROM

Eater found the PIC16-based board used an external 16 kilobyte EEPROM. The external chip seemed likely to contain the naughty word list since the microcontroller only has 2 kilobytes of ROM.

After removing the chip from the PCB, placing it into a breadboard, connecting an Arduino Uno, and writing a bit of code, Eater dumped its contents. As expected, this chip contains a list of ASCII words. TVGuardian's engineers arranged the words in six blocks that are each 256 bytes in length.

An intriguing part about this organization is that each word has one to three bytes of metadata associated with it. Using bitwise operators and a feat of linguistic legerdemain, Eater determined which words were on the strict list, which were on the allow list, and which replacement words matched with the naughty words.

Check out Technology Connections's video to learn more about the TVGuardian. Then, watch Ben Eater's video on dumping and decoding the EEPROM. Finally, check out another hacker's experience with the ROM for even more context.

James Lewis
Fan of making things that blink, fly, or beep. Host on element14 Presents, baldengineer.com, AddOhms, and KN6FGY.
Latest articles
Sponsored articles
Related articles
Latest articles
Read more
Related articles