Getting Samsung SmartTV to work with newer 2015 TVs

[emlama]

I have a ju7100 Samsung TV and it looks like the protocol for connecting has changed. Any insights on this?

[imbrianj]

I've heard the newer models had change their connectivity method, but haven't been able to test it. Do you know if the same port is available? You can visit your TV's server at:

http://[IP Address]:55000

If it is listening, you'll get a "ERR_EMPTY_RESPONSE" code. If it's not listening, you'll get "ERR_CONNECTION_REFUSED".

If it does allow a connection, you can try adding additional logging to the controller to find out it's response. Unfortunately, Samsung has traditionally been pretty difficult to debug since their responses are so unhelpful.

Hope this helps! Let me know what you find - or if you need any help in debugging.

[emlama]

This is what NMAP shows:

Starting Nmap 7.01 ( https://nmap.org ) at 2016-02-12 14:24 EST
Nmap scan report for 192.168.105.21
Host is up (0.0026s latency).
Not shown: 994 closed ports
PORT     STATE SERVICE
7676/tcp open  imqbrokerd
8000/tcp open  http-alt
8001/tcp open  vcom-tunnel
8080/tcp open  http-proxy
9090/tcp open  zeus-admin
9999/tcp open  abyss
MAC Address: FC:F1:36:53:45:37 (Samsung Electronics)
Device type: general purpose
Running: Linux 3.X
OS CPE: cpe:/o:linux:linux_kernel:3
OS details: Linux 3.2 - 3.10, Linux 3.2 - 3.13
Network Distance: 1 hop

One thing I have noticed is that a sample iOS app I'm using requires me to enter a PIN. I haven't figured out how this protocol works. It looks like the app notifies a remote server and that remote server then notifies the TV. I haven't been able to see the communication through wireshark but I'm sure it's because I don't know what I'm doing :)

[imbrianj]

Interesting. Yeah, definitely a new protocol. The PIN may be all local - similar to what LG does for authentication. When LG TVs go through a factory reset, they generate a random PIN that is then used till the next factory reset. It requires that PIN to be sent in the header of the request.

...but that's just me speculating.

[timelery]

I created a console application that can be used to send remote control commands to Samsung TVs that are using the new encrypted communication protocol. Model 2014+ Samsung TVs.

Run the executable to setup the pairing connection and follow the instructions. Once the pairing is complete the program can be executed with a command argument to send one of the available commands to the TV. I have tested it on two different H Series TVs successfully. Let me know if you have any issues. I hope it proves useful for others.

[img]http://i1190.photobucket.com/albums/z457/eagleeyedesign/Snap1_zpskmlvqoon.png[/img]

[b]Download Here:[/b] https://drive.google.com/open?id=0B4rFn8xXaiKsa1NidjUzOHh6ZGs

[imbrianj]

@timelery very cool! Do you have documentation that you used to create this? Ideally, I'd like to port the logic to node.js and integrate with SwitchBoard natively.

[imbrianj]

@timelery Do you have this code in a repo I can look at in order to port?

[andreypopov]

please, port to linux

[imbrianj]

@timelery - Do you intend to make your code open source so it could be ported to SwitchBoard (for use on a wider group of OS's)?

Otherwise, if anyone here can point me to documentation for doing something similar, I can try to roll something into SwitchBoard natively.

[nelis249]

@imbrianj - looks like timelery wrote it in .NET. I can try to get source code from it.

I have a question for you though. Have you ever tried sending a message to your TV to create a custom drop down notification on the TV screen? Not from a TV app but from something external.

[imbrianj]

@nelis249 if you could provide some info, that'd be a huge help!

I have not tried sending a custom drop down notification to the TV. I didn't know that was possible - at least for the (admittedly dated) version I have. If you have docs and are willing to test, I can certainly look at it.

[nunofgs]

Any word on the encrypted protocol?

[imbrianj]

@nunofgs All I'm aware of is that the protocol has changed, what I currently have for Samsung TV support does not work on (at least) 2015+ models, newer model TVs have ports 7676, 8000, 8001, 8080, 9090 and 9999 open and that someone has claimed to have gotten something to work with it in a closed-source .NET application. As I don't have the device to test first-hand, and the source or methods have not been provided, it's not possible for me to port to JS for wider / platform agnostic use. I'm afraid that until @timelery is able to provide his source - or someone else is able to shed some light on how to get this to work, I'll be unable to do much.

[imbrianj]

Relevant findings: https://community.smartthings.com/t/samsung-smart-tv-support/741/71

[DanielRuf]

But these ports are not available on 2014/2015 models.

[imbrianj]

@DanielRuf unfortunately, without the devices to test on - or someone willing to help develop and test, there's not a lot I can do :cry:

[DanielRuf]

@imbrianj Afaik the protocol is encrypted and so far no one could decrypt it. But Samsung mentions control codes for RJ45 and RS232C ports in the manuals but obviously these are not usable. Any idea why they provide these in the manual but do not provide any open ports for this?

[timelery]

The protocol is indeed encrypted and impossible to decompile. It was built with c++ and wrapped in c# to be utilized by their windows application. However I did in fact decompile the windows application and utilized some of it's functionality to create a command line utility for use in home automation solutions. One of the things I reailzed during this effort was that utlkizing an IR transciever that could be utilkized in code would be a much easier method. However, I will publish the code I have put in place for the protocol tools. stay tuned.

[DanielRuf]

@timelery awesome, thanks.

[timelery]

The command line utility is here. Make sure any relevant samsung tvs are powered on and on wifi before launching the tool or else it will not find them during the initial search.

https://github.com/timelery/NewestSamsung-RemoteControl

Here is the decompiled smart view 2 application that actually works. If you load it up into VS 2015 you should be able to launch it. It may prove useful.

https://github.com/timelery/SmartView2-Modified

[imbrianj]

Huge thanks, @timelery !

[imbrianj]

Took a cruise through the code - as mentioned, it's likely not going to be super straight forward. If anyone has interest in pursuing this, feel free to reach out and I can work with you. For now, I'll try and look a bit more into it - but I have a few other things on my plate for the short-term. Again, thanks a ton @timelery - this is a huge help!

[DanielRuf]

Maybe the sourcecode of the Android app is also helpful.

You can use dex2jar and JD-GUI to get the sourcecode written in Java, see http://stackoverflow.com/a/4177581/753676

File - Save All Sources (Ctrl - Alt - S) exports the class files to Java files.

ILSpy is also very helpful.

[amitkshirsagar13]

looks like sammote has got it working completely in iPhone, it does ask for pin displayed on Samsung TV for pairing.

[imbrianj]

@amitkshirsagar13 interesting. Sounds very similar to LG's authentication. They generate a PIN on every factory reset - and it's sent in the POST AUTH header IIRC. LG, however, does document how to talk to their TVs :disappointed:

[mkotek]

I have KS7000 and linux box, ready to test if anyone is willing to send me something to test and report the results back.

[davorf]

Hello!

I have H6500 series TV and I've tried communicating with it via web socket, but couldn't get past PIN authorization. I'm also willing to help testing, if anyone has an idea how to accomplish communication with these TVs.

Best regards, Davor

[amitkshirsagar13]

https://github.com/MathieuDebit/smarttv-webremote-client check this link not sure if this is working with new series of TVs with Samsung.

[davorf]

Hello!

I've looked at the link you've provided, but unfortunately, it uses samsung-remote package, which is made for older TVs (before 2014, uses port 55000). I've also found these 2 links, and they are (supposedly) working on 2016 TVs, but I was unable to made it work on my 2014 TV.

https://github.com/kyleaa/homebridge-samsungtv2016

https://github.com/krzynio/python-samsung-smarttv-2016

Maybe this could be a starting point for understanding new Samsung IP control protocol.

Best regards, Davor

[imbrianj]

This ticket has been sitting here a while. Without access to the device - or someone willing to help out in development and testing, it's pretty tough. I'm happy to educate myself as possible with each of the links posted. Those repos posted by @davorf seemed very promising and I can work on some basic porting to JS, but it may not be worth the effort if @davorf had issues having them work. If anyone can find (open source) code that's promising, please reach out!

Leaving this ticket open. I'll keep looking for a solution and happy to hear from those that may have suggestions or ability to test. I suspect most of the traffic here is for people outside the interest of this specific repo - and primarily those looking for general info regarding this device. SwitchBoard is MIT licensed, so if / when it's ported, other projects can pick out the distilled /devices/[device]/controller.js and integrate with any project with relatively little work.

[davorf]

Hello @imbrianj

I've tried this Python script multiple times, as-is and with some changes, but haven't been able to make it work on my 2014 Samsung. It looks like 2014 TV's have a specific protocol that differs from both, older and newer series. The only thing that is working, at least partially, is this command line application:

https://github.com/timelery/Samsung-RemoteControl/tree/master/SmartTVRemoteControl

Some commands are working, and some cause an exception, but I guess the core of the application should be good enough, at least as a starting point.

Best regards, Davor

[twistedpixel]

@imbrianj Hey, I have a 2015 Samsung (JS8500) and I'm trying to get this to work so I can control the TV over HomeBridge (for HomeKit).

I'd be happy to try and work with you to see if we can figure it out?

However, your warning of "bricking it" due to a log rotation oversight has terrified me. Not sure my extended guarantee covers this sort of behavior!!

[imbrianj]

@twistedpixel I'm not sure how real the risk is to the device. I've heard of some older Samsungs losing Internet features after the log has reached capacity. It was basically filling the entire onboard memory with garbage over a long period of polling (measured in months or even years). Point being: polling for on/off state is not something the device was intended for and any consequences that arise from doing so cannot be the responsibility of the person that provided the software "as is". TL;DR: it'll probably work fine, but if it breaks something, don't sue someone on github.

I'll look again at the repo posted by @davorf and try to provide a gist of a distilled controller file that at least tries to connect and log out basic info. It might take me a while to get to it, though. If someone that owns one of these devices is willing to set up an instance of SwitchBoard, dropping in the controller, template and config might be easier than writing something from scratch.

If / when I have something worth testing, it'd also be helpful if someone willing to test could join the IRC channel so we could quickly test things out.

[twistedpixel]

I'm happy to set up Switchboard on my Pi and test whatever you come up with.

The tv I have for testing is a 2015 JS8500. I'm going to try connecting both the tv and my iPhone to an adhoc network created on my Mac and see what I can dump out through WireShark as the official SmartView app tries to connect and authenticate.

Might be able to use this data to help develop the controller if we can reverse-engineer the conversation.

I'll do it a few times too, to see if the data differs.

Bit of a long shot but who knows, might get lucky.

[eclair4151]

I am also willing to try an help. I am trying to setup a raspberry pi to control my samsung tv (UN65MU6300) 2017 model. For the new M series tvs there is no longer a pin required. Just a dialog will appear on the tv asking if you approve the remote device. the app http://imkapps.com/mytifi/ has support fort the new tvs , so i am going to try to see if i can duplicate some of the logic from the app.

[imbrianj]

This is still on my todo list - but I have a few other things higher in my priorities right now. I'm also biding my time in the hopes that someone can reveal more details making my efforts less frustrating :innocent:

[eclair4151]

I am in the middle of some work right now from decompiling one the android Samsung tv apps that works on my tv. If i get my thing working ill post it on github and link it here so you can see what i did

[eclair4151]

So I was able to get my setup all up and running using the samsungctl python library. It supports the new websocket protocol which works on my 2017 tv. I just had to set the port to 8001 and method to websocket and it worked like magic

[imbrianj]

@eclair4151 looks like maybe this is a good place to start looking? https://github.com/Ape/samsungctl/blob/master/samsungctl/remote_websocket.py

[eclair4151]

@imbrianj yea thats exactly what i used to get my setup working

[imbrianj]

Nice! It looks like it uses the same keymap values, which makes things nice. Quickly glancing through, I don't really see anything regarding the encryption, just some base64 encoding of the string. The older version didn't really have encryption, it was just really picky about how strings were encoded IIRC ( https://github.com/imbrianj/switchBoard/blob/master/devices/samsung/controller.js#L53-L86 ). When I heard things were properly encrypted, I got a bit worried. This makes things look much more simple than I had expected. Thanks for sharing - this is a huge help!

[eclair4151]

Yea thats what confused me too. i had heard in a few places the new protocol was encrypted. but looks like for now at least its pretty simple to make requests over websocket

[ProZsolt]

This won't work with J and H series TVs, but perfectly OK for K

[eclair4151]

Hmm well i have an M series TV and it works on that so i guess it works on K and M series

[imbrianj]

I'm not entirely sure what the name is for that samsungctl is base64 encoding and sending at connect. I've cobbled together this simple Switchboard device controller for some testing. I'm pretty certain it will fail spectacularly, but will need to do some trial and error to get things working - and I do not have access to the device. https://gist.github.com/imbrianj/77c51bf029148ec166b9f74b4e7a9160

[imbrianj]

A lot of discussions going on in the above referenced samsungctl issue tracker. Hoping someone will be able to provide some proof of concept there.

[eclair4151]

@imbrianj i have a proof of concept im making right now. hoping to have it done tonight.

[eclair4151]

@imbrianj Still view rough around the edges but here is my POC for encrypted TV communication https://github.com/eclair4151/samsung_encrypted_POC/tree/master

[twistedpixel]

Very cool @eclair4151, it’s a shame we can’t decompile the DLL to see what it’s doing to create the keys.

[tdudek]

I stumbled upon this issue because of the referenced issue https://github.com/Ape/samsungctl/issues/22 :)

I just want to let you know guys, I've successfully connected to my TV with a pure JavaScript code.

You can find the proof of concept here: https://github.com/tdudek/samsung-remote-models-2014-and-newer

Hope this helps some of you. Would be nice if you share your results 👍

[DanielRuf]

Awesome =)