Hey foks - I thought I would share some additional information. It seems there is a way to get telnet and root access to the TV. requires you get UART connection to the service port.
I was poking around the moquitto config and found out that port 10001 is a mqtt websockets port if that helps anyone trying to integrate to the hisense tv.
My Hisense 75P7 doesnt use TLS for MQTT and I cant see anything in the mosquitto directories with certificates. let me know if you need anything else off the tv. I have full root access.
Hi.
Every time the TV is off, the mosquitto broker gets this constant error, filling the log to a huge one after some hours.
1592744733: Connecting bridge hisensemqtt (192.168.5.6:36669)
1592744736: Socket error on client local.HomeAssistant, disconnecting.
Is there a way to avoid showing this error or maintaining the TV mqtt broker accessible?
Thanks.
This is my successful experience getting this to work, with a TV Hisense H43B7320, with its firmware version V0000.01.00a.K0117.
In: https://github.com/tiagofreire-pt/tv_hisense_home_assistant/
I dont think there is a really away to stop the connection error messages when the TV is off as basically the OS is suspended. Another option would be to get root access to the TV using the Service Port + enabling telnet then modifying the mosquitto.conf file under /3rd_rw/remoteapp/bin and setting up the bridge in the other direction. So when the TV turns on it sends the MQTT message to the homeassitant broker.
@K-1, Thanks!
Do you have the pinout of that service port or any documentation that may help on that, please?
For those interested in debugging or exploring more the MQTT broker inside the TV, you can use the software MQTT Explorer (http://mqtt-explorer.com/) with these configs:
Sure to connect to the service port you will need a USB to TTL UART adapter and you will need a stereo/ headphone end like one pictured in the link or below. You can buy these cheap on ebay.
Follow the guide on here. I had to reverse the TX/RX on my tv for it to work.
https://forum.xda-developers.com/showpost.php?p=68737765&postcount=84
Note to ensure telnetd is persistent after each reboot you need to add via the update script as its the only thing so far we know of that runs on each start up
Modify /3rd_rw/software-update/run-OtaUpgrade.sh
Add this to the start or end of the script:
busybox telnetd -l /bin/sh
Then connect it as follows:
I should also note that hisense sends a lot of data home. Every button pressed is sent home via HTTPS. I highly recommend blocking unified-ter-na.hismarttv.com domain if you have the capability to.
Thanks, @K-1. I’ll try it.
Regarding the domain, I have pihole on my lan, and blocks it through the list https://dbl.oisd.nl/. Good catch!
For those interested, there is a chance to install HTML5 apps on these TVs:
- open on TV stock browser
- in the address bar, type hisense://debug
- on the page type the name of the application and its URL
- find the application icon in Google. copy and paste the url of the icon
- Click the INSTALL button
- can use the app
lots of applications here → apptest.staging.foxxum.com
In: Rooting MediaTek Based Linux Smart TV | Page 10 | XDA Forums
Could we open the local HA instance through this method?
It would be great to have topics to control more things, like “picture settings”. Then you could, per example, dim the backlight or change the image mode with automations when you change your room’s lights, or depending the hour, etc. Does anyone know how to discover which topics are the TV suscribed to? All of them… it would be wonderful
You inspired me to hexdump the remoteservice binary on the TV. Interestingly enough we can see all possible keys, maybe that can help someone! by the way remoteservice runs as root on the tv so if you can escape it somehow you should be able to launch telnetd to gain root access.
I wonder if you could pass on a command such as busybox telnetd -l /bin/sh by escaping it somehow?
00003cd0 4b 45 59 5f 48 4f 4d 45 00 00 00 00 4b 45 59 5f |KEY_HOME....KEY_|
00003ce0 4d 45 4e 55 00 00 00 00 4b 45 59 5f 43 48 41 4e |MENU....KEY_CHAN|
00003cf0 4e 45 4c 55 50 00 00 00 4b 45 59 5f 43 48 41 4e |NELUP...KEY_CHAN|
00003d00 4e 45 4c 44 4f 57 4e 00 4b 45 59 5f 56 4f 4c 55 |NELDOWN.KEY_VOLU|
00003d10 4d 45 55 50 00 00 00 00 4b 45 59 5f 56 4f 4c 55 |MEUP....KEY_VOLU|
00003d20 4d 45 44 4f 57 4e 00 00 4b 45 59 5f 52 45 54 55 |MEDOWN..KEY_RETU|
00003d30 52 4e 53 00 4b 45 59 5f 44 4f 57 4e 00 00 00 00 |RNS.KEY_DOWN....|
00003d40 4b 45 59 5f 4c 45 46 54 00 00 00 00 4b 45 59 5f |KEY_LEFT....KEY_|
00003d50 52 49 47 48 54 00 00 00 4b 45 59 5f 55 50 00 00 |RIGHT...KEY_UP..|
00003d60 4b 45 59 5f 4f 4b 00 00 4b 45 59 5f 30 00 00 00 |KEY_OK..KEY_0...|
00003d70 4b 45 59 5f 31 00 00 00 4b 45 59 5f 32 00 00 00 |KEY_1...KEY_2...|
00003d80 4b 45 59 5f 33 00 00 00 4b 45 59 5f 34 00 00 00 |KEY_3...KEY_4...|
00003d90 4b 45 59 5f 35 00 00 00 4b 45 59 5f 36 00 00 00 |KEY_5...KEY_6...|
00003da0 4b 45 59 5f 37 00 00 00 4b 45 59 5f 38 00 00 00 |KEY_7...KEY_8...|
00003db0 4b 45 59 5f 39 00 00 00 4b 45 59 5f 4d 55 54 45 |KEY_9...KEY_MUTE|
00003dc0 00 00 00 00 4b 45 59 5f 52 45 44 00 4b 45 59 5f |....KEY_RED.KEY_|
00003dd0 47 52 45 45 4e 00 00 00 4b 45 59 5f 59 45 4c 4c |GREEN...KEY_YELL|
00003de0 4f 57 00 00 4b 45 59 5f 42 4c 55 45 00 00 00 00 |OW..KEY_BLUE....|
00003df0 4b 45 59 5f 53 54 4f 50 00 00 00 00 4b 45 59 5f |KEY_STOP....KEY_|
00003e00 50 4c 41 59 00 00 00 00 4b 45 59 5f 50 41 55 53 |PLAY....KEY_PAUS|
00003e10 45 00 00 00 4b 45 59 5f 42 41 43 4b 53 00 00 00 |E...KEY_BACKS...|
00003e20 4b 45 59 5f 46 4f 52 57 41 52 44 53 00 00 00 00 |KEY_FORWARDS....|
00003e30 4b 45 59 5f 50 52 45 56 49 4f 55 53 00 00 00 00 |KEY_PREVIOUS....|
00003e40 4b 45 59 5f 4e 45 58 54 00 00 00 00 4b 45 59 5f |KEY_NEXT....KEY_|
00003e50 43 48 41 4e 4e 45 4c 44 4f 54 00 00 4b 45 59 5f |CHANNELDOT..KEY_|
00003e60 43 48 41 4e 4e 45 4c 4c 49 4e 45 00 4b 45 59 5f |CHANNELLINE.KEY_|
00003e70 52 45 43 4f 52 44 00 00 4b 45 59 5f 43 43 00 00 |RECORD..KEY_CC..|
00003e80 4b 45 59 5f 4d 54 53 00 4b 45 59 5f 45 58 49 54 |KEY_MTS.KEY_EXIT|
00003e90 00 00 00 00 4b 45 59 5f 50 4f 57 45 52 00 00 00 |....KEY_POWER...|
00003ea0 4b 45 59 5f 45 50 47 00 4b 45 59 5f 50 56 52 00 |KEY_EPG.KEY_PVR.|
00003eb0 4b 45 59 5f 54 49 4d 45 53 48 49 46 54 00 00 00 |KEY_TIMESHIFT...|
00003ec0 4b 45 59 5f 54 58 54 00 4b 45 59 5f 53 55 42 54 |KEY_TXT.KEY_SUBT|
00003ed0 49 54 4c 45 00 00 00 00 4b 45 59 5f 4c 41 4e 47 |ITLE....KEY_LANG|
00003ee0 55 41 47 45 00 00 00 00 4c 69 74 5f 54 41 42 00 |UAGE....Lit_TAB.|
00003ef0 4c 69 74 5f 43 41 50 00 4c 69 74 5f 53 48 49 46 |Lit_CAP.Lit_SHIF|
00003f00 54 00 00 00 4c 69 74 5f 53 50 41 43 45 00 00 00 |T...Lit_SPACE...|
00003f10 4c 69 74 5f 43 54 52 4c 00 00 00 00 4c 69 74 5f |Lit_CTRL....Lit_|
00003f20 41 4c 54 00 4c 69 74 5f 45 4e 54 45 52 00 00 00 |ALT.Lit_ENTER...|
00003f30 4c 69 74 5f 44 45 4c 45 54 45 00 00 4c 69 74 5f |Lit_DELETE..Lit_|
00003f40 42 41 43 4b 53 50 41 43 45 00 00 00 4c 69 74 5f |BACKSPACE...Lit_|
00003f50 45 53 43 00 4c 69 74 5f 49 4e 53 45 52 54 00 00 |ESC.Lit_INSERT..|
00003f60 4c 69 74 5f 48 4f 4d 45 00 00 00 00 4c 69 74 5f |Lit_HOME....Lit_|
00003f70 45 4e 44 00 4c 69 74 5f 50 55 00 00 4c 69 74 5f |END.Lit_PU..Lit_|
00003f80 50 44 00 00 4c 69 74 5f 4c 45 46 54 00 00 00 00 |PD..Lit_LEFT....|
00003f90 4c 69 74 5f 52 49 47 48 54 00 00 00 4c 69 74 5f |Lit_RIGHT...Lit_|
00003fa0 55 50 00 00 4c 69 74 5f 44 4f 57 4e 00 00 00 00 |UP..Lit_DOWN....|
00003fb0 4c 69 74 5f 46 31 00 00 4c 69 74 5f 46 32 00 00 |Lit_F1..Lit_F2..|
00003fc0 4c 69 74 5f 46 33 00 00 4c 69 74 5f 46 34 00 00 |Lit_F3..Lit_F4..|
00003fd0 4c 69 74 5f 46 35 00 00 4c 69 74 5f 46 36 00 00 |Lit_F5..Lit_F6..|
00003fe0 4c 69 74 5f 46 37 00 00 4c 69 74 5f 46 38 00 00 |Lit_F7..Lit_F8..|
00003ff0 4c 69 74 5f 46 39 00 00 61 00 00 00 62 00 00 00 |Lit_F9..a...b...|
00004000 63 00 00 00 64 00 00 00 65 00 00 00 66 00 00 00 |c...d...e...f...|
00004010 67 00 00 00 68 00 00 00 69 00 00 00 6a 00 00 00 |g...h...i...j...|
00004020 6b 00 00 00 6c 00 00 00 6d 00 00 00 6e 00 00 00 |k...l...m...n...|
00004030 6f 00 00 00 70 00 00 00 71 00 00 00 72 00 00 00 |o...p...q...r...|
00004040 73 00 00 00 74 00 00 00 75 00 00 00 76 00 00 00 |s...t...u...v...|
00004050 77 00 00 00 78 00 00 00 79 00 00 00 7a 00 00 00 |w...x...y...z...|
00004060 41 00 00 00 42 00 00 00 43 00 00 00 44 00 00 00 |A...B...C...D...|
00004070 45 00 00 00 46 00 00 00 47 00 00 00 48 00 00 00 |E...F...G...H...|
00004080 49 00 00 00 4a 00 00 00 4b 00 00 00 4c 00 00 00 |I...J...K...L...|
00004090 4d 00 00 00 4e 00 00 00 4f 00 00 00 50 00 00 00 |M...N...O...P...|
000040a0 51 00 00 00 52 00 00 00 53 00 00 00 54 00 00 00 |Q...R...S...T...|
000040b0 55 00 00 00 56 00 00 00 57 00 00 00 58 00 00 00 |U...V...W...X...|
000040c0 59 00 00 00 5a 00 00 00 30 00 00 00 31 00 00 00 |Y...Z...0...1...|
000040d0 32 00 00 00 33 00 00 00 34 00 00 00 35 00 00 00 |2...3...4...5...|
000040e0 36 00 00 00 37 00 00 00 38 00 00 00 39 00 00 00 |6...7...8...9...|
000040f0 54 41 42 00 43 41 50 00 53 48 49 46 54 00 00 00 |TAB.CAP.SHIFT...|
00004100 53 50 41 43 45 00 00 00 43 54 52 4c 00 00 00 00 |SPACE...CTRL....|
00004110 41 4c 54 00 45 4e 54 45 52 00 00 00 44 45 4c 45 |ALT.ENTER...DELE|
00004120 54 45 00 00 42 41 43 4b 53 50 41 43 45 00 00 00 |TE..BACKSPACE...|
00004130 7b 00 00 00 7d 00 00 00 3b 00 00 00 27 00 00 00 |{...}...;...'...|
00004140 2c 00 00 00 2e 00 00 00 2f 00 00 00 5c 00 00 00 |,......./...\...|
00004150 2b 00 00 00 7e 00 00 00 45 53 43 00 49 4e 53 45 |+...~...ESC.INSE|
00004160 52 54 00 00 48 4f 4d 45 00 00 00 00 45 4e 44 00 |RT..HOME....END.|
00004170 50 55 00 00 50 44 00 00 4c 45 46 54 00 00 00 00 |PU..PD..LEFT....|
00004180 52 49 47 48 54 00 00 00 55 50 00 00 44 4f 57 4e |RIGHT...UP..DOWN|
00004190 00 00 00 00 46 31 00 00 46 32 00 00 46 33 00 00 |....F1..F2..F3..|
000041a0 46 34 00 00 46 35 00 00 46 36 00 00 46 37 00 00 |F4..F5..F6..F7..|
000041b0 46 38 00 00 46 39 00 00 5f 00 00 00 3d 00 00 00 |F8..F9.._...=...|
000041c0 7c 00 00 00 3a 00 00 00 22 00 00 00 3c 00 00 00 ||...:..."...<...|
000041d0 3e 00 00 00 3f 00 00 00 21 00 00 00 23 00 00 00 |>...?...!...#...|
000041e0 24 00 00 00 25 00 00 00 5e 00 00 00 26 00 00 00 |$...%...^...&...|
000041f0 2a 00 00 00 28 00 00 00 29 00 00 00 40 00 00 00 |*...(...)...@...|
00004200 5b 00 00 00 5d 00 00 00 e2 82 a9 00 ef bf a5 00 |[...]..
Nice finding! Perhaps you could have a look at other binaries like the one for platform_service, which receives commands like “changevolume” or “getvolume”. It would be great if there were other capabilities hidden.
@Alex-M-GitHub - thanks for your work and publishing something installable.
I contributed early to this thread but haven’t really needed anything beyond just being interested.
Now I have a need to set the source (to HDMI2) on my TV using a script.
How far off being able to do this with your custom component are we/you?
Check this:
And this:
Hi there,
Been pawing at this for a couple of hours. I noticed when using OpenSSL with my TV no cert was being returned. Using the TV remote, I was able to confirm that the TV’s certificate mode was off.
I simply removed the bridge_cafile /ssl/hisense.crt line in the hisense.conf file, restarted MQTT and boom, it worked!
SK
I have had bit of a read over this thread. My overall need is to get the Hisense 65S8 (2020) model into HomeKit through Homebridge; I have never used Home Assistant before but do know if I set it up I can get it to bridge straight into HomeKit. I have used these threads before to discover the HTTP API of my aircon and used that in HomeKit.
I was able to use MQTT Explorer for the first time ever and confirmed I am seeing the same commands as mentioned in the thread. I tried using the homebridge-mqttthings plug-in to create a TV Accessory but cannot get feedback or place commands; I am not sure if the plug-in works for this TV or if maybe I am not translating the commands correctly into the plug-in.
My two questions would be does anyone have any guidance for getting this into Homebridge or HomeKit? And is it possible to type one of these subscribe or ‘get’ commands into my browser url and see a ‘data dump’ of sorts that can be used? Sorry if that is a dumb question but iv never dealt with MQTT before. If this is possible, I can translate this into a separate Homebridge plug-in called homebridge-cmd4 (like I did for my aircon API).
Is anyone able to provide any guidance to the questions above? I have installed Hassio on a spare Raspberry Pi 3B, but find the instructions a little less intuitive than using Homebridge. If ihave understood the thread correctly, this is the most successful attempts so far?
Still it looks like the config represents it as a switch accessory? If I was to bring that over to HomeKit, it would appear as the Switch accessory instead of the TV accessory if am guessing correctly.
Got this working after a couple of hours messing around. Anyone having issues where the ON/OFF switch automatically turns off after a second, resulting in not being able to turn the TV off from the control card? If you can turn the switch off before it automatically does it, the TV does actually turn off but I haven’t been able to find out why it turns off at this stage.
Hi all, I installed Hisensetv custom component from HACS. It did not work for my TV, so decided to uninstall. However, the uninstall deletes the entire custom_components directory, so on reboot, my entire installation is messed up. Fortunately I able to restore a recent snapshot. Tried again, just to confirm what cased the deletion of the entire custom_component directory, and happened again and had to restore.
What can I do to remove this integration? Can I just delete the directory hisensetv in custom_components? will that remove the integration?
Anyone’s assistance will be appreciated. Thank you
Hello @K-1,
I couldn’t help but noticing your project, since I have a SmartHisenseTV with MQTT support. Unlike others I can perfectly communicate with my TV with an MQTT client on my computer and use the Wake-on-LAN feature. However, I am a beginner in what’s related to Hass.io. I tried to add the sensors and switches just like your configuration, but failed to do it. On the Lovelace panel, the switch just doesn’t appear. Can you please post your part of configurations.yaml that is about this project again, for me?
Something else, would there be any way to integrate this with the HomeAssistant’s Apple HomeKit support? Thank you so much in advance.