IP Remote Commands

C

Carlosfandango

New Member
Anyone have any information on how to control the box via the IP network. I know there is already a Humax app but I wish to write my own.

I have played around with the ports sending various HTTP commands as you would normally do for such devices but to no avail. I have looked all of the web and can't find anything so would be grateful if anyone has anything to share on the topic.
 
The Humax app I've investigated before (and for which there's a compatibility shim available for the HDR Fox T2 custom firmware) sends UDP packets to port 22558.
The packets look like this example for the OK button being pressed.

Code: 
00000000    686d7872610000007263750000000000    hmxra...rcu.....
00000010    3030353800000000f410783a01000000    0058......x:....

The 0058 is the text representation of the code in hex; full table below. The first hex number in each row is what you need.
I don't know what the bytes from 0x18 onwards are, they may constitute a checksum of some kind that you'd need to reverse engineer (or just grab from a packet capture for each remote control code).

Code: 
   { 0x80, 0x6e }, /* TEXT */
   { 0x39, 0x46 }, /* SUB */
   { 0x48, 0x45 }, /* AUDIO */
   { 0x95, 0x65 }, /* REWIND */
   { 0x90, 0x60 }, /* PLAY */
   { 0x94, 0x64 }, /* F/FORWARD */
   { 0x92, 0x63 }, /* STOP */
   { 0x91, 0x62 }, /* PAUSE */
   { 0x93, 0x61 }, /* RECORD */
   { 0x54, 0x11 }, /* UP */
   { 0x55, 0x15 }, /* DOWN */
   { 0x52, 0x12 }, /* LEFT */
   { 0x53, 0x14 }, /* RIGHT */
   { 0x58, 0x13 }, /* OK */
   { 0x57, 0x16 }, /* EXIT */
   { 0x56, 0x41 }, /* BACK */
   { 0x47, 0x6f }, /* SEARCH */
   { 0x3b, 0x6f }, /* PLUS */
   { 0x70, 0x1f }, /* VOL+ */
   { 0x71, 0x40 }, /* VOL- */
   { 0x50, 0x10 }, /* CH+ */
   { 0x51, 0xf }, /* CH- */
   { 0x31, 0x1b }, /* GUIDE */
   { 0x32, 0x4b }, /* HOME */
   { 0x20, 0x1c }, /* RED */
   { 0x21, 0x1d }, /* GREEN */
   { 0x22, 0x1a }, /* YELLOW */
   { 0x23, 0x1e }, /* BLUE */
   { 0x10, 0xc }, /* ZERO */
   { 0x11, 0x3 }, /* ONE */
   { 0x12, 0x4 }, /* TWO */
   { 0x13, 0x5 }, /* THREE */
   { 0x14, 0x6 }, /* FOUR */
   { 0x15, 0x7 }, /* FIVE */
   { 0x16, 0x8 }, /* SIX */
   { 0x17, 0x9 }, /* SEVEN */
   { 0x18, 0xa }, /* EIGHT */
   { 0x19, 0xb }, /* NINE */
   { 0x72, 0x18 }, /* MUTE */
   { 0x78, 0x4e }, /* WIDE */
 
af123 said:
The Humax app I've investigated before (and for which there's a compatibility shim available for the HDR Fox T2 custom firmware) sends UDP packets to port 22558.
Click to expand...
This is very useful. Thanks! :thumbsup:
A quick test on a 2000T shows that "OK","CH+" and "CH-" work as expected using your first "Code" item as the UDP packet (changing the relevant byte for CH+/-).
Whether it works on a 4000T, I leave that to the OP to find out.
Are there any other similar gems hidden away in the custom firmware section that could be helpful (eg. other ports that do something useful)?
 
EEPhil said:
A quick test on a 2000T shows that "OK","CH+" and "CH-" work as expected using your first "Code" item as the UDP packet (changing the relevant byte for CH+/-).
Click to expand...
Interesting. That implies that the trailer is fixed or not important.
My project was to create a bridge between the Humax app and the HDR Fox T2 so I just need to listen on port 22558 and extract (and map) the incoming codes. I had no need to look at the last 8 bytes for that. For anyone who doesn't know, this is the rc-app-bridge package that allows you to use the Humax remote control app to control an HDR Fox T2.

EEPhil said:
Are there any other similar gems hidden away in the custom firmware section that could be helpful (eg. other ports that do something useful)?
Click to expand...
Nothing comes to mind I'm afraid (although to be honest I'd completely forgotten about this package until prompted by the Carlosfandango )
 
The test I've done from my PC to the Humax 2000T sends just the UDP packet similar to af123's first "Code" to the Humax at the port indicated. (My Content Sharing is on). No "discovery" was required.

I've tested all the codes listed above, and most behave perfectly for the 2000T. Just replace "58" with the relevant code from the table.
However - 0x47 (Search) does nothing, and 0x32 (Home) activates the Menu function on the 2000T. ox3b (Plus) is OPT+.
In addition:
0x01 - Off
0x30 - i
0x35 - List
0x37 - Screen Resolution (cycles 1080i, 1080p, 576i on my screen - but as I'm connecting using RCA cables...)
ox3d - Media
0x3e - Portal
0x63 - Radio/TV
0x96 - Skip Backwards
0x97 - Skip Forwards

:oops: Edited to rectify a few mistakes.
 
Last edited:
EEPhil said:
The test I've done from my PC to the Humax 2000T sends just the UDP packet similar to af123's first "Code" to the Humax at the port indicated. (My Content Sharing is on). No "discovery" was required.

I've tested all the codes listed above, and most behave perfectly for the 2000T. Just replace "58" with the relevant code from the table.
However - 0x47 (Search) does nothing, and 0x32 (Home) activates the Menu function on the 2000T. ox3b (Plus) is OPT+.
In addition:
0x01 - Off
0x30 - i
0x35 - List
0x37 - Screen Resolution (cycles 1080i, 1080p, 576i on my screen - but as I'm connecting using RCA cables...)
ox3d - Media
0x3e - Portal
0x63 - Radio/TV
0x96 - Skip Backwards
0x97 - Skip Forwards

:oops: Edited to rectify a few mistakes.
Click to expand...

Seems that the codes are the same for the 4000T when sniffing the packets with WireShark. I am use PacketSender on MacOS but for some reason can't get it to work though. Can I ask what you are using to send the UDP packets?
 
Here is a screen capture of what I am trying to send via PackSender - am I doing something wrong?
 

Attachments

  • Untitled.png
    Untitled.png
    580.5 KB · Views: 27
I wrote a smallish program in Java. I have no current knowledge of PacketSender.
In Java I created a byte array containing the contents of the second column in the first "Code" of af123's first reply
eg.
Code: 
byte[] sendData =
   {
      (byte) 0x68, (byte) 0x6d, (byte) 0x78, (byte) 0x72,
      (byte) 0x61, (byte) 0x00, (byte) 0x00, (byte) 0x00, 
      (byte) 0x72, (byte) 0x63, (byte) 0x75, (byte) 0x00, 
      (byte) 0x00, (byte) 0x00, (byte) 0x00, (byte) 0x00, 
      (byte) 0x30, (byte) 0x30, (byte) '0',  (byte) '0', 
      (byte) 0x00, (byte) 0x00, (byte) 0x00, (byte) 0x00,
      (byte) 0xf4, (byte) 0x10, (byte) 0x78, (byte) 0x3a,
      (byte) 0x01, (byte) 0x00, (byte) 0x00, (byte) 0x00
   };
Using the table in the second "Code" I replaced elements 18 & 19 in sendData (the '0' above) with, for example (byte) '5' and (byte) '8'.
There exists some functions within Java to send the whole of sendData in UDP form. This works.
The whole array needs to be sent. I'm not sure, from the PacketSender image, that this is what you are doing.
 
EEPhil said:
I wrote a smallish program in Java. I have no current knowledge of PacketSender.
In Java I created a byte array containing the contents of the second column in the first "Code" of af123's first reply
eg.
Code: 
byte[] sendData =
   {
      (byte) 0x68, (byte) 0x6d, (byte) 0x78, (byte) 0x72,
      (byte) 0x61, (byte) 0x00, (byte) 0x00, (byte) 0x00, 
      (byte) 0x72, (byte) 0x63, (byte) 0x75, (byte) 0x00, 
      (byte) 0x00, (byte) 0x00, (byte) 0x00, (byte) 0x00, 
      (byte) 0x30, (byte) 0x30, (byte) '0',  (byte) '0', 
      (byte) 0x00, (byte) 0x00, (byte) 0x00, (byte) 0x00,
      (byte) 0xf4, (byte) 0x10, (byte) 0x78, (byte) 0x3a,
      (byte) 0x01, (byte) 0x00, (byte) 0x00, (byte) 0x00
   };
Using the table in the second "Code" I replaced elements 18 & 19 in sendData (the '0' above) with, for example (byte) '5' and (byte) '8'.
There exists some functions within Java to send the whole of sendData in UDP form. This works.
The whole array needs to be sent. I'm not sure, from the PacketSender image, that this is what you are doing.
Click to expand...

Perfect thanks - that makes sense. I'll knock something up in Swift to see how that goes.


Sent from my iPhone using Tapatalk
 
I obtained PacketSender and had a go... Here is the resulting capture. Sending the packet had the same effect as pressing OK on the remote.
ps01.png
 
Looks nice. I presume that, unlike the Humax app, it doesn't need content sharing to be turned on.
btw, it will only work on the HDR Fox T2 if it's running the Custom Firmware and has the rc-app-bridge package installed.
 
The ability to use it with multiple HDRs would be an advantage. It's a bit of a faff having to change the IP address in the app each time you wish to control an alternate HDR.
 
Wallace said:
The ability to use it with multiple HDRs would be an advantage. It's a bit of a faff having to change the IP address in the app each time you wish to control an alternate HDR.
Click to expand...

Already working on that bit to allow device detection from a list and then the choice of which one to use.
 
You must log in or register to reply here.
Back
Top