Index of /utilities/unix/tv

tv.pl ===== tv.pl is written to control the Sharp LC-70UD27U TV. It can probably control most modern Sharp TVs to some extent or another, though it'll need work. Help! ----- There are some commands in this protocol that are as yet unexplained, in particular: RSPW ACHA CHWB GSEL KLCC RMDL DX2U SCPV See notes below for more details. Can you work out what they do? Let me know on this reddit thread: http://www.reddit.com/r/ReverseEngineering/comments/2q6zff/sharp_lc70ud27u_tv_remote_control_protocol_has/ ...or e-mail me at <ian@hixie.ch>. Documentation ------------- The Sharp LC-70UD27U TV's TCP control protocol is documented in the LC60_70UD27U_OM.pdf file, page 94 (labeled 7-3). I found a copy of this file here: http://www.ssap.com/snRefMaterialDisplay.aspx?ID=rmljkAKv3H8%3d Some sleuthing around found similar documentation for other TVs: http://elitelcdtv.com/_pdf/Elite-RS232-IP%20Control.pdf The protocol ------------ The documentation above is not the most... clear. It describes the general form for commands: four characters to specify the command, and four characters to specify the arguments. Commands are terminated by 0x0D bytes. No encoding is specified, but for the sake of simplicity we'll assume UTF-8. [CMND][ARGS][0x0D] The arguments are typically numeric, left-aligned, padded with spaces on the right. For example: [VOLM][50 ][0x0d] Or to put it in C-like terms: "VOLM50 \r" According to the documentation, some commands accept the argument "?" or "????" to find out the current state. It doesn't say which. By brute force I found those that responded to "?" (I haven't tested for commands that support "????" but not "?"; spot testing suggests that they are treated as synonyms). In practice, I found at least one command where the arguments are just an arbitray-length string (at least 4 characters long), and as far as I can tell the encoding is really ASCII, not UTF-8; and bytes with the high bit set get ignored. I haven't studied this very carefully. The TV is supposed to respond with some data or "OK" or "ERR" followed by a 0x0D byte, but in practice some commands respond with multiple lines (separated by 0x0D), and, more importantly, some commands in some situations will just hang. The existence of the following commands is documented, and although many don't act exactly as documented, or have super-vague documentation, they are relatively straight-forward: Command: POWR Arguments: numeric: 0 or 1; or ? Turn the TV on or off, in theory. 0 = turns the TV off 1 = supposedly, turn the TV on; it only seems to work if "quickstart" is enabled in the settings (menu > setup > quick start mode > on), in which case the TV is basically already on anyway ? = returns 1 if the TV is on, 0 if the TV is off with "quickstart" enabled. If the TV is off with "Quickstart" on, then every command except POWR will return ERR. If the TV is off with "Quickstart" off, then connections won't even be accepted, so "POWR1 " won't work. Command: ITGD Arguments: ignored Switch to next enabled input. Command: ITVD Arguments: ignored Switch to the last selected TV channel. Command: IAVD Arguments: numeric: 1..5; or ? Select an input: 1 = HDMI1 2 = HDMI2 3 = HDMI3 4 = HDMI4 5 = Component or Composite ? = returns current input, 1..5 Command: AVMD Arguments: numeric: 0..7, 17; or ? Switch to a different AV mode: 0 = switch to next AV mode 1 = switch to AV mode "STANDARD" 2 = switch to AV mode "MOVIE" 3 = switch to AV mode "GAME" 4 = switch to AV mode "USER" 5 = switch to AV mode "DYNAMIC(Fixed)" 6 = switch to AV mode "DYNAMIC" 7 = switch to AV mode "PC" 17 = switch to AV mode "MOVIE THX" ? = returns current AV mode, 1..7, 17 Command: VOLM Arguments: numeric: 0..100; or ? Set the volume: 0..100 = set the volume to that value ? = return the current volume, 0..100 Command: HPOS Arguments: numeric: -8..8; or ? Position the picture: -8..8 = set the horizontal position of the picture ? = return the current horizontal position If the picture can't be positioned (e.g. HDMI), then only 0 is accepted as input. Command: VPOS Arguments: numeric: -8..8; or ? Position the picture: -8..8 = set the vertical position of the picture ? = return the current vertical position If the picture can't be positioned (e.g. HDMI), then only 0 is accepted as input. Command: WIDE Arguments: numeric 0..4 or 9, or ? Select picture mode: 0 = switch to next mode 1 = 4:3 2 = side-stretch 3 = zoom 4 = stretch 9 = 16:9 ? = return the current picture mode, 1..4 or 9 Exactly which arguments work depends on the current input. The values above were tested with HDMI and Composite/Component input types. The documentation gives different argument values for other inputs (5..8 for "PC" (meaning maybe the AV mode?), and 10 and 11 for the internal modes like USB), which I haven't tested. Command: MUTE Arguments: numeric 0..2, or ? Set the mute mode: 0 = toggle mute state 1 = enable mute state 2 = disable mute state ? = return the mute state, 1 or 2 Command: ACSU Arguments: numeric: 0..7; or ? Select the surround sound mode: 0 = switch to next surround sound mode 1 = switch to Normal mode 2 = switch to Off mode 4 = switch to 3D Hall mode 5 = switch to 3D Movie mode 6 = switch to 3D Standard mode 7 = switch to 3D Stadium mode ? = return the surround sound mode, 1..6 Command: OFTM Arguments: numeric: 0..4; or ? Set the sleep timeout: 0 = disable the sleep timeout 1 = set the sleep timeout to 30 minutes 2 = set the sleep timeout to 60 minutes 3 = set the sleep timeout to 90 minutes 4 = set the sleep timeout to 120 minutes ? = return 0 if the timeout is disabled, otherwise return the number of minutes remaining on the sleep timeout, 1..120 Command: TVNM Arguments: must be 1 Return the TV's name, as configured in the settings. Command: MNRD Arguments: must be 1 Return "UD27U", supposedly the TV's model. Command: SWVN Arguments: must be 1 Return "114U1411181", supposedly some software version number. The following commands are documented but confusing or just not very well tested by me (I don't have a way to receive TV channels, so the channel-related ones are hard for me to test): Command: RSPW Arguments: numeric: 0..2 Documented as "Power on command setting", with: 0 = the power command is rejected 1 = the power on command is accepted (RS-232C) 2 = the power on command is accepted (IP) I've no idea what this actually does. It certainly doesn't seem to stop the POWR command from working. Command: ACHA Arguments: ignored unless it starts with "?" or has more than four characters Documented as "audio selection toggle", but I've _no_ idea what it actually does. It responds with "ERR" if the arguments starts with "?" or has more than four characters. Command: DCCH Arguments: numeric: 2..69 for air or 1..135 for cable; or ? This is supposed to change the channel to an analog channel. It hangs if the TV has TV channels disabled. "?" returns the current value or ERR if the TV isn't tuned to an analog channel. Command: DA2P Arguments: numeric: 0100..9999; or ? This is supposed to change the channel to a digital air channel of the form ##.##. It hangs if the TV has TV channels disabled. "?" returns the current value or ERR if the TV isn't tuned to a ##.## digital channel. In my testing I can't get it to pay any attention to the last two digit. Command: DC2U Arguments: numeric: 1..999; or ? This is supposed to change the channel to a digital air channel of the form ###.###, giving the first three digits. It hangs if the TV has TV channels disabled. "?" returns the current value or ERR if the TV isn't tuned to a ###.### digital channel. Command: DC2L Arguments: numeric: 0..999; or ? This is supposed to change the channel to a digital air channel of the form ###.###, giving the last three digits. It hangs if the TV has TV channels disabled. "?" returns the current value or ERR if the TV isn't tuned to a ###.### digital channel. In my testing I can't get it to pay any attention to the last two digits. Call this after DC2U, not before. Command: DC10 Arguments: numeric: 0..9999; or ? This is supposed to change the channel to a digital air channel of the form 0####, with the argument giving the last four digits. In my testing this never works. Command: DC11 Arguments: numeric: 0..6383; or ? This is supposed to change the channel to a digital air channel of the form 1####, with the argument giving the last four digits. In my testing this never works. Command: CHUP Arguments: ignored This is supposed to change the channel as if the channel-up button on the remote was pressed. It hangs if the TV has TV channels disabled. Command: CHDW Arguments: ignored This is supposed to change the channel as if the channel-down button on the remote was pressed. It hangs if the TV has TV channels disabled. Command: CLCP Arguments: supposedly ignored This is supposed to toggle closed captions, but I've not been able to test it. Command: IPPV Arguments: must be 1 Return "0100" followed by two 0x0D bytes instead of just one. It's documented as "the currently supported version of IP protocol is displayed" but it's not clear what this means. Command: RCKY Arguments: numeric: 0..61 Press a key on the remote control. The values are: 0 = 0 1 = 1 2 = 2 3 = 3 4 = 4 5 = 5 6 = 6 7 = 7 8 = 8 9 = 9 10 = . 11 = ent 12 = power 13 = display 14 = power-source 15 = rw 16 = play 17 = ff 18 = pause 19 = prev 20 = stop 21 = next 22 = rec 23 = option 24 = sleep 25 = rec-stop 26 = power-saving 27 = cc 28 = av-mode 29 = view-mode 30 = flashback 31 = mute 32 = vol- 33 = vol+ 34 = chup 35 = chdw 36 = input 37 = 37 38 = menu 39 = smart-central 40 = enter 41 = up 42 = down 43 = left 44 = right 45 = return 46 = exit 47 = ch 48 = 48 49 = 49 50 = a 51 = b 52 = c 53 = d 54 = freeze 55 = app1 56 = app2 57 = app3 58 = 2d/3d 59 = netflix 60 = aal 61 = manual Some of these values are from the second source mentioned above, the rest from the official documentation. Since the TV returns "ERR" for commands it doesn't know, I brute- forced the command space to find if there were any other commands that might be undocumented. I tried all four-character combinations of A..Z and 0..9, and I tried them with the arguments "1", "2", and "?". (I haven't tried lowercase a-z, and I haven't tried commands that aren't four letters long followed by one of those three arguments followed by three spaces). Here are the commands I found: Command: KLCD Arguments: A string with four or more characters, ASCII Show the string in the bottom right corner of the screen. Command: IDIN Arguments: numeric: 0..4, 11..15, 50..53, 81, 82; or ? Switch the input: 0 = cable analog (1) 1 = air analog (1) 2 = cable digital (3) 3 = air digital (3) 4 = cable analog (3) 11, 50 = HDMI1 (50) 12, 51 = HDMI2 (51) 13, 52 = HDMI3 (52) 14, 53 = HDMI4 (53) 15 = component (11) 81 = Home Network (11) 82 = SD/USB (11) ? = returns the number in parentheses corresponding to the current selected entry from the list above, or ERR of actively switching or if there's no corresponding entry in the list above The HDMI inputs return ERR if you're already on that channel. The behaviour of values 0..4 aren't entirely clear to me. Command: RDIN Arguments: ignored so long as it's numeric in the range 0..9999 Return a value based on the current input, as follows: HDMI1 returns "5000" HDMI2 returns "5100" HDMI3 returns "5200" HDMI4 returns "5300" Component and Composite return "1100" Analog TV return "0100" Digital TV with channel in the form ##.## returns "0300" Digital TV with channel in the form ###.### returns "0400" Mircast, Bluetooth, Manual screens return "-100" If the input is actively switching, returns "ERR" If the Home Network or USB/SD screens are showing, the value returned is whatever the value for the previous screen was. Notice that the values here are similar to the "IDIN?" values. Command: INP5 Arguments: numeric: 0..2; or ? Select a specific input for the shared Component/Composite input: 0 = probably "autoselect" 1 = probably "composite" 2 = "component" ? = returns the current setting, 0..2 Command: DMSL Arguments: numeric: 0 or 1; ? Show or hide a pointless overlay: 0 = hides the demo overlay 1 = shows the demo overlay ? = returns the current setting, 0 or 1 The overlay claims to show the value of upscaling on a 4K display, or something, but doesn't seem to actually do so. Command: CHWB Arguments: unclear This seems to be an incomplete "TV+Web" split-screen mode. I haven't tested this much since when I enable it it often crashed the TV and on at least one occasion I've had to hard-reboot the device. Command: GSEL Arguments: four characters Return a multiline string built as follows. A first line based on the fourth character of the argument: 0 = "Avpos: DYNAMIC" 1 = "Avpos: STANDARD" 2 = "Avpos: MOVIE" 3 = "Avpos: DYNAMIC-HD" 4 = "Avpos: STANDARD-HD" 5 = "Avpos: MOVIE-HD" 6 = "Avpos: STANDARD-3D" 7 = "Avpos: PURE" else = "ERR:Arg3" ...then if it wasn't "ERR:Arg3", a second line based on the third characters of the argument: 0 = "CTEMP: OFF" 1 = "CTEMP: HI" 2 = "CTEMP: HI-MID" 3 = "CTEMP: MID" 4 = "CTEMP: MID-LO" 5 = "CTEMP: LO" else = "ERR:Arg2" ...then if it wasn't "ERR:Arg2", a third line based on the third characters of the argument: 0 = "WB: OFF" 1 = "WB: ON" else = "ERR:Arg1" ...then if it wasn't "ERR:Arg2", a final line "OK". The lines are separated by 0x0D bytes. The first character of the argument is ignored. I haven't the first clue what this is supposed to do. Command: KLCC Arguments: numeric? No idea what this does. Command: RMDL Arguments: numeric? Return "4". No idea what that means. Command: DX2U Arguments: numeric: 0..999? No idea what this does. Command: SCPV Arguments: ? My notes say I once got this to return "3.0", but I can't reproduce it. The Script ---------- The tv.pl script assumes that the TV can be resolved in DNS as "tv", and that it's configured to use port 10002. It then reads "tv.cfg" and uses the first line as the username and the second line as the password. You control the TV by giving command line arguments. Run "tv.pl help" for details.