Advanced Touch REMOTE reverse engineering
Posted: Wed Sep 23, 2015 9:55 am
Hello everyone,
My goal is to find a way to control an H-Series TV (e.g. H6400) remotely (without having it rooted - at least not until a suitable root is released). I've looked at ways to control it over wifi, but it can only be done with Samsung's apps (for Windows/Android), and sadly the Android app doesn't run on my phone. From all I read, H series (and beyond) use encrypted communication for Wifi remote, and Samsung is determined to keep third party remotes out.
So, I was thinking of what would be needed to reverse the protocol used by the bluetooth remote (Advanced Touch Remote) and have a different device (phone or Linux PC) pretend to be the Advanced Touch Remote instead. This would allow me to control the TV remotely, over the internet (with the phone/PC as a wifi-to-bluetooth bridge).
So, let's experiment. A simple test with a camera will show you that the smart remote has an IR diode that is used to power the TV on or off. So, power can't be controlled via Bluetooth. Boo!
Next: if you use a phone and press the remote's Return + Guide buttons, you will see the bluetooth device as discoverable by your phone and you can connect to it (it didn't require any PIN). It then behaves like a keyboard (input device). The TV is not discoverable, but you can find out the bluetooth MAC in the service menu.
I also tried pairing my remote to my Linux PC, but I wasn't able to pair with it. I tried the standard codes, 0000, 1234, etc, but nothing worked. Does anybody know what the pairing code is? It's probably hardcoded somewhere in the TV firmware.
Here's my plan after I can pair with it via PC:
1. Use Wireshark to sniff bluetooth traffic and see what gets sent
2. Or use something like xev to sniff out the keycodes being sent on keypresses or remote movement.
If getting the remote to pair with a PC, or extracting the keypresses is more difficult, there would be two more options:
1. Use specialized hardware + software defined radio to sniff the bluetooth traffic at radio level - possible, but requires expensive hardware: https://www.usenix.org/legacy/event/woo ... index.html
2. Use a rooted TV to do the packet capture at the bluetooth level or intercept process calls to see what happens/what packets get sent.
With this information, my next plan is to do this:
1. Create a program using uinput that will generate those keycodes to a /dev/input/* device: http://thiemonge.org/getting-started-with-uinput. Ideally the program registers a new input device and listens for keys on a particular network port. It then converts those keys to their keycodes and sends them as input.
2. Export the /dev/input device as a HID keyboard emulating the Advanced Touch Remote using hidclient: http://anselm.hoffmeister.be/computer/h ... ex.html.en. (Note, by using this program you can temporarly use your hardware keyboard from your Linux PC as a keyboard for your Samsung TV via Bluetooth - needs testing): http://support-us.samsung.com/cyber/pop ... idx=411196&
So, I'd like to ask the community's help further in case this idea is helpful for anyone. Ideally, it should lead to tools to control the TV via bluetooth from linux (command-line), and could be used by NAS, HTPC and other Linux devices lying around. Also, with rooted android phones, it might be portable to android one day.
Let me know what to try next!
My goal is to find a way to control an H-Series TV (e.g. H6400) remotely (without having it rooted - at least not until a suitable root is released). I've looked at ways to control it over wifi, but it can only be done with Samsung's apps (for Windows/Android), and sadly the Android app doesn't run on my phone. From all I read, H series (and beyond) use encrypted communication for Wifi remote, and Samsung is determined to keep third party remotes out.
So, I was thinking of what would be needed to reverse the protocol used by the bluetooth remote (Advanced Touch Remote) and have a different device (phone or Linux PC) pretend to be the Advanced Touch Remote instead. This would allow me to control the TV remotely, over the internet (with the phone/PC as a wifi-to-bluetooth bridge).
So, let's experiment. A simple test with a camera will show you that the smart remote has an IR diode that is used to power the TV on or off. So, power can't be controlled via Bluetooth. Boo!
Next: if you use a phone and press the remote's Return + Guide buttons, you will see the bluetooth device as discoverable by your phone and you can connect to it (it didn't require any PIN). It then behaves like a keyboard (input device). The TV is not discoverable, but you can find out the bluetooth MAC in the service menu.
I also tried pairing my remote to my Linux PC, but I wasn't able to pair with it. I tried the standard codes, 0000, 1234, etc, but nothing worked. Does anybody know what the pairing code is? It's probably hardcoded somewhere in the TV firmware.
Here's my plan after I can pair with it via PC:
1. Use Wireshark to sniff bluetooth traffic and see what gets sent
2. Or use something like xev to sniff out the keycodes being sent on keypresses or remote movement.
If getting the remote to pair with a PC, or extracting the keypresses is more difficult, there would be two more options:
1. Use specialized hardware + software defined radio to sniff the bluetooth traffic at radio level - possible, but requires expensive hardware: https://www.usenix.org/legacy/event/woo ... index.html
2. Use a rooted TV to do the packet capture at the bluetooth level or intercept process calls to see what happens/what packets get sent.
With this information, my next plan is to do this:
1. Create a program using uinput that will generate those keycodes to a /dev/input/* device: http://thiemonge.org/getting-started-with-uinput. Ideally the program registers a new input device and listens for keys on a particular network port. It then converts those keys to their keycodes and sends them as input.
2. Export the /dev/input device as a HID keyboard emulating the Advanced Touch Remote using hidclient: http://anselm.hoffmeister.be/computer/h ... ex.html.en. (Note, by using this program you can temporarly use your hardware keyboard from your Linux PC as a keyboard for your Samsung TV via Bluetooth - needs testing): http://support-us.samsung.com/cyber/pop ... idx=411196&
So, I'd like to ask the community's help further in case this idea is helpful for anyone. Ideally, it should lead to tools to control the TV via bluetooth from linux (command-line), and could be used by NAS, HTPC and other Linux devices lying around. Also, with rooted android phones, it might be portable to android one day.
Let me know what to try next!
