LGconnectd

From CometVisu
Jump to: navigation, search

New smart TVs from LG are not only able to be controlled via the documented RS232 interface but also via an undocumented network interface. The LG TV Remote App is using this interface, it should be possible to reverse engineer this protocol through it.

This page will end up in a daemon to freely interact via network with the TV but till then it's trying to become a documentation of the protocol by reverse engineering of the remote network codes. Help is highly appreciated!

Protocol

Start up

Discovery

During start up the app is using avahi / zeroconf / bonjour to discover TVs in the local network.

It is looking for a resource named '_lg_dtv_wifirc._tcp'

Once it discovered the TV and it was selected on the phone it's doing a HTTP GET request:

http://<ip>:8080/hdcp/api/data?target=version_info

that gets answered by

<?xml version="1.0" encoding="utf-8"?><envelope><HDCPError>200</HDCPError><HDCPErrorDetail>OK</HDCPErrorDetail><data><hdcpVersion>1.0</hdcpVersion><serviceVersion>dtv_wifirc1.0</serviceVersion></data></envelope>

Authentication

The App sends

POST /hdcp/api/auth HTTP/1.1
Content-Type: application/atom+xml
Content-Length: 74
Host: 192.168.0.116:8080
Connection: Keep-Alive

<?xml version="1.0" encoding="utf-8"?><auth><type>AuthKeyReq</type></auth>

wich ist responded by the TV by

HTTP/1.1 200 OK
Date: Fri Dec 30 13:44:44 2011 GMT
Server: LG HDCP Server
Pragma: no-cache
Cache-Control: no-store, no-cache, must-revalidate
Connection: close
Content-Length: 122
Content-Type: application/atom+xml; charset=utf-8

<?xml version="1.0" encoding="utf-8"?><envelope><HDCPError>200</HDCPError><HDCPErrorDetail>OK</HDCPErrorDetail></envelope>

A little window pops up on the TV now and shows a Code.

This is entered in the App and then sent to the TV:

POST /hdcp/api/auth HTTP/1.1
Content-Type: application/atom+xml
Content-Length: 92
Host: 192.168.0.116:8080
Connection: Keep-Alive

<?xml version="1.0" encoding="utf-8"?><auth><type>AuthReq</type><value>XXXXXX</value></auth>

and answered by

HTTP/1.1 200 OK
Date: Fri Dec 30 13:28:08 2011 GMT
Server: LG HDCP Server
Pragma: no-cache
Cache-Control: no-store, no-cache, must-revalidate
Connection: close
Content-Length: 150
Content-Type: application/atom+xml; charset=utf-8

<?xml version="1.0" encoding="utf-8"?><envelope><HDCPError>200</HDCPError><HDCPErrorDetail>OK</HDCPErrorDetail><session>114859659</session></envelope>

At the end the clients sends

GET /hdcp/api/data?target=context_ui&session=114859659 HTTP/1.1
Host: 192.168.0.116:8080
Connection: Keep-Alive

which gets answered by

HTTP/1.1 200 OK
Date: Fri Dec 30 13:28:08 2011 GMT
Server: LG HDCP Server
Pragma: no-cache
Cache-Control: no-store, no-cache, must-revalidate
Connection: close
Content-Length: 168
Content-Type: application/atom+xml; charset=utf-8

<?xml version="1.0" encoding="utf-8"?><envelope><HDCPError>200</HDCPError><HDCPErrorDetail>OK</HDCPErrorDetail><session>114859659</session><mode>VolCh</mode></envelope>

Runtime

During run time it seems that the communication is split up.

The TV sends(!) HTTP POST requests to the App on status change. And the App sends UDP packets to the TV with user input.

HTTP POST

The TV might send information like

POST /hdcp/api/event HTTP/1.1
Host: 192.168.0.119:8080
Pragma: no-cache
Cache-Control: no-cache
Content-Type: application/atom+xml
Content-Length: 245
Connection: Close
User-Agent: Mozilla/5.0 (compatible; LG-HttpClient-v1.0.3 UPnP/1.1; MSIE 8.0; Windows NT 5.1; LG_UA; AD_LOGON=LGE.NET; .NET CLR 2.0.50727; .NET CLR 3.0.04506.30; .NET CLR 3.0.04506.648; LG_UA; AD_LOGON=LGE.NET; LG NetCast.TV-2011)

<?xml version="1.0" encoding="utf-8"?><event><session>114859659</session><name>ChannelChanged</name><chname>RTL 2</chname><physicalNum>16</physicalNum><sourceIndex>2</sourceIndex><minor>65535</minor><major>5</major><chtype>cable</chtype></event>

and the client answer with

HTTP/1.1 200 OK
Date: Fri, 30 Dec 2011 13:28:19 GMT+00:00
Server: HttpComponents/1.1
Content-Type: application/atom+xml; charset=UTF-8
Connection: Close

<?xml version="1.0" encoding="utf-8"?><envelope><HDCPError>200</HDCPError><HDCPErrorDetail>OK</HDCPErrorDetail><session>114859659</session>

UDP

The UDP packets are sent to port 7070.

They are made up out of

Bytes Content
0-3 CRC32 checksum of the whole message (bytes 0-3, i.e. this bytes, are set to "0x00" for the CRC32 calculation)
4-7 Session ID
8-9 Command 1
10-13 Length of following array
14... data array (fist four bytes, i.e. 14-17 might be Command 2)

Example

0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21
73 1c 2b 95 8b 9e d8 06 02 00 08 00 00 00 06 00 00 00 fe ff ff ff
CRC32 Session ID Command 1 Array length Array
114859659 2 8

Commands

The known commands (i.e. values for "Command 1") are:

Command 1 Name Parameters
1 key input 1x 4 bytes
2 touch move 2x 4 bytes
3 touch click 1x 4 bytes
5 set favorite channel 2x 4 bytes
7 channel change 2x 4 bytes
9 text input Command 2 = 1, String

Tested devices

All these tests are currently done on a 47LW659. But it is expected that it works on all network enabled LG TVs released in 2011. So it should probably work with:

  • LZ9800, LZ970, LZ9700, LZ9600
  • LW9600, LW950, LW9500
  • LW770, LW7700, LW7500
  • LW659, LW650
  • LW579, LW570, LW5700, LW5600, LW550, LW5500
  • LV570, LV5700, LV550W, LV550T, LV5500, LV5400
  • LV375, LV373S, LV372S, LV3700
  • LK550, LK530
  • PZ950
  • PZ750
  • PZ570, PZ550, PZ540