I spent my weekend trying to reverse engineer the new remote app for iOS (Samsung Smart View 2.0) which connects to my 2014 H-series TV.
Did not get very far in understanding how it all connects together, though. I managed to capture some traffic by setting up a proxy from my iPhone to my computer and intercepting all outgoing traffic using the BURP Suite and Wireshark.
192.168.1.159 is the IP of my TV
When connecting the app, the first thing that happens:
Code: Select all
POST http://192.168.1.159:8001/ms/1.0
POST Body:
{
"method" : "ms.device.getInfo",
"id" : "C61806B0-4FAB-4CBA-95A8-493970E30727",
"jsonrpc" : "2.0",
"params" : {
}
}
..which responses this info:
{
"method": "ms.device.getInfo",
"result": {
"DUID": "SHCHVWLLD3JAM",
"Model": "14_GOLFS",
"NetworkType": "wireless",
"SSID": "Lojtis",
"IP": "192.168.1.159",
"FirmwareVersion": "T-GFSDEUC-1142.0",
"CountryCode": "SE",
"DeviceName": "[TV]Samsung LED46",
"DeviceID": "7XCHU5ARPRFEG",
"ModelDescription": "Samsung TV RCR",
"ModelName": "UE46H7000",
"UDN": "07bfa480-0082-1000-8cd0-5056bf7cf441",
"Resolution": "1920x1080",
"ServiceURI": "http://192.168.1.159:8001/ms/1.0/",
"DialURI": "http://192.168.1.159:8001/ws/apps/",
"Capabilities": [
{
"name": "samsung:multiscreen:1",
"port": "8001",
"location": "/ms/1.0/"
}
]
},
"id": "C61806B0-4FAB-4CBA-95A8-493970E30727",
"jsonrpc": "2.0"
}
Then, a GET request to
http://192.168.1.159:7676/smp_25_ is made:
Code: Select all
GET http://192.168.1.159:7676/smp_25_
response:
<?xml version="1.0"?>
<root xmlns='urn:schemas-upnp-org:device-1-0' xmlns:sec='http://www.sec.co.kr/dlna' xmlns:dlna='urn:schemas-dlna-org:device-1-0'>
<specVersion>
<major>1</major>
<minor>0</minor>
</specVersion>
<device>
<deviceType>urn:dial-multiscreen-org:device:dialreceiver:1</deviceType>
<friendlyName>[TV]Samsung LED46</friendlyName>
<manufacturer>Samsung Electronics</manufacturer>
<manufacturerURL>http://www.samsung.com/sec</manufacturerURL>
<modelDescription>Samsung TV NS</modelDescription>
<modelName>UE46H7000</modelName>
<modelNumber>1.0</modelNumber>
<modelURL>http://www.samsung.com/sec</modelURL>
<serialNumber>20090804RCR</serialNumber>
<UDN>uuid:07bfa481-0082-1000-b3aa-5056bf7cf441</UDN>
<sec:deviceID>7XCHU5ARPRFEG</sec:deviceID>
<sec:ProductCap>Resolution:1280X720,Y2014</sec:ProductCap>
<serviceList>
<service>
<serviceType>urn:dial-multiscreen-org:service:dial:1</serviceType>
<serviceId>urn:dial-multiscreen-org:serviceId:dial</serviceId>
<controlURL>/smp_27_</controlURL>
<eventSubURL>/smp_28_</eventSubURL>
<SCPDURL>/smp_26_</SCPDURL>
</service>
</serviceList>
<sec:Capabilities>
<sec:Capability name='samsung:multiscreen:1' port='8001' location='/ms/1.0/'></sec:Capability>
</sec:Capabilities>
</device>
</root>
After that, the app locates the TV on the network according to the UPNP protocol (looks like it in wireshark anyway..). Then the following requests are made:
Code: Select all
POST http://192.168.1.159:8080/ws/pairing?step=1&app_id=12345&device_id=7E808D46-D5B4-45F8-9D4D-3195C13DDE1D&type=1&type=1
response:
"auth_Data":{"auth_type":"SPC","GeneratorServerHello":"010200000000000000008A000000063635343332319EE66F7B6A48BAAEEC88C795A8EF11AE8FB74C2D2520CDB3A578E2B324883F2F85253F165CEB73A8F621D0E77C073F4FDC34D6707E51E9A0C519554D2F620321C63CBF9D3D4F0FE9B961A5AD3E19DC2A63091360A67263F0A115C0AD075F33C9C027210C1FE636AB36C7EC598774D2FE130A81E3F11DDC387C48387D5130ED6A0000000000"}
Code: Select all
POST http://192.168.1.159:8080/ws/pairing?step=2&app_id=12345&device_id=7E808D46-D5B4-45F8-9D4D-3195C13DDE1D&type=1&type=1
response:
"auth_Data":{"auth_type":"SPC","request_id":"0","ServerAckMsg":"01030000000000000000146F0C01563895DDAE104D3DB6A6F230129F1CFB550000000000"}
Code: Select all
DELETE http://192.168.1.159:8080/ws/apps/CloudPINPage/run
Code: Select all
GET http://192.168.1.159:8000/common/1.0.0/service/startService?appID=com.samsung.companion
Code: Select all
GET http://192.168.1.159:8000/socket.io/1/?t=1406423639422
response:
z1dV9gDLH1YOgMq2APc9:60:60:websocket,htmlfile,xhr-polling,jsonp-polling
After all these requests, the app is connected to the TV and I can see the remote control UI. However, when I push a button, no commands are sent over either the sockets or other HTTP traffic, so it must be using some UDP protocol. But! I tried to log all tcp/udp events to intercept volume changes etc but did not manage to make any sense of it. Very annoying!
It would be really neat if the websocket actually could be used for controlling the TV without having to use UPNP or other non-familiar protocol.
Did some of you guys get any further on this?