Hisense TV Control

Sym0nd0 · March 30, 2020, 10:36am

Thanks for this! What’s it called on HACS, I’ve tried searching for Hisense but getting no results?

pemontto · April 28, 2020, 8:41am

You need to add this as a new repo in HACS. Go to the setting page and under CUSTOM REPOSITORIES add https://github.com/newAM/hisensetv_hass as an integration repository.

LC7894 · April 29, 2020, 5:05pm

That would be truly amazing!

Nerdletics · April 30, 2020, 5:49am

Source Selection would be great. My Harmony Hub can’t change the sources correctly.

yusufptl · May 24, 2020, 10:36am

Can you please share you configuration and template for the Hisense TV?

I have installed the python file and can connect to the TV now need to have it in the lovelace hi

Thank you

CaptainSolidus · June 11, 2020, 6:13pm

Here are some of the MQTT commands I’ve found to work on my TV, the 55H8G. Source and app selection works well, although I had to capture it from the RemoteNOW app. Button presses work well, especially if you’re building a remote in the UI. It seems as if MQTT commands get put into a queue if you issue them while the TV is in standby (as in, not completely powered off), and they’ll get executed once the WOL packet is sent.

Button presses are as follows. These work over CEC.

/remoteapp/tv/remote_service/XX:XX:XX:XX:XX:XY$normal/actions/sendkey

Power = KEY_POWER
Back = KEY_RETURNS
Menu = KEY_MENU
Exit = KEY_EXIT
Pause = KEY_PAUSE
Play = KEY_PLAY (play and pause work the same)
Stop = KEY_STOP
Up = KEY_UP
Down = KEY_DOWN
Left = KEY_LEFT
Right = KEY_RIGHT
Fast Forward = KEY_FORWARDS
Backwards = KEY_BACKWARDS
Home = KEY_HOME
Back = KEY_BACK
Menu = KEY_MENU
RGYB Buttons = KEY_RED, KEY_BLUE, etc.
Numkeys = KEY_0, 1, 2, 3, etc.
Channeldot = KEY_CHANNELDOT
Channel Up = KEY_CHANNELUP
Channel Down = KEY_CHANNELDOWN
Closed Captions = KEY_CC

For app launching, here’s an example MQTT publish and the JSON for it. This launches the app immediately, from every screen and input I could try.

/remoteapp/tv/ui_service/XX:XX:XX:XX:XX:XY$normal/actions/launchapp

{
  "appIcon": "",
  "appId": "",
  "has_detail_page": 0,
  "isLocalApp": 1,
  "name": "Plex",
  "storeType": 0,
  "type": 0,
  "url": "com.plexapp.android",
  "urlType": 0
}

Sources basically work identically to the app launching. You can just copy and paste the JSON and change HDMI 1 to the other numbers, they’re identical. I don’t use OTA or cable TV, so I cannot test channel inputs, though it would probably work okay with the remote codes above.

/remoteapp/tv/ui_service/XX:XX:XX:XX:XX:XY$normal/actions/changesource

{"displayname":"HDMI 1","hotel_mode":"","isDemo":false,"is_lock":"","is_signal":"","sourceid":"3","sourcename":"HDMI 1"}

Volume changing took a bit, because I just couldn’t understand how it worked. This is partially due to me using ARC, it doesn’t allow for arbitrary volume settings, only +1 or -1 per MQTT publish. If you’re using TV audio, I would assume that the value you publish would be the new setting. The TV will always return a JSON response here, formatted like so. This allows you to get the current volume setting.

/remoteapp/mobile/broadcast/platform_service/actions/volumechange
{"volume_type":1,"volume_value":11}

Volume type appears to be TV Audio, ARC, or Bluetooth (on my TV), with a value of 0, 1, or 2.

This is not how you set volume, nor does sending remote codes seem to work consistently. The best way I’ve found is as follows.

/remoteapp/tv/platform_service/XX:XX:XX:XX:XX:XY$normal/actions/changevolume

Just send a value between 0 - 100 – no formatting needed. If you’re using ARC (at least in my testing), a value above your current volume will increment up by one, and down by one if you’re sending a lower value. If you’re not using ARC, it seems as if it just sets it to that volume. I have yet to find a way to mute with ARC, as I can’t find a key command that works as a mute button.

Here’s one I have yet to find actually useful, but it’s worth putting in here. You can send keyboard inputs, including delete, enter, space, and special characters. The formatting for some of the special characters does make sense (@ is SHIFT_2), but it’s unwieldy, to say the least. Here’s the topic.

/remoteapp/tv/remote_service/XX:XX:XX:XX:XX:XY$normal/actions/input

Here’s one that seems to list known channels, but like I said, I don’t use OTA antennas so YMMV.

/remoteapp/mobile/XX:XX:XX:XX:XX:XY$normal/platform_service/data/getchannellistinfo

This will return a JSON response with all installed apps, makes it easy to format the app changing commands above.

/remoteapp/mobile/XX:XX:XX:XX:XX:XY$normal/ui_service/data/applist

Here’s one for known sources

/remoteapp/mobile/XX:XX:XX:XX:XX:XY$normal/ui_service/data/sourcelist

That’s all I’ve been able to mess with the last day or two. Hope this helps someone out!

glorifiedg · June 11, 2020, 11:30pm

Is someone with a lovelace remote for hisensetv can share the yaml?

K-1 · June 16, 2020, 12:02pm

Hey foks - I thought I would share some additional information. It seems there is a way to get telnet and root access to the TV. requires you get UART connection to the service port.

I was poking around the moquitto config and found out that port 10001 is a mqtt websockets port if that helps anyone trying to integrate to the hisense tv.

K-1 · June 21, 2020, 12:32pm

My Hisense 75P7 doesnt use TLS for MQTT and I cant see anything in the mosquitto directories with certificates. let me know if you need anything else off the tv. I have full root access.

ReDaLeRt · June 21, 2020, 1:09pm

Hi.

Every time the TV is off, the mosquitto broker gets this constant error, filling the log to a huge one after some hours.

1592744733: Connecting bridge hisensemqtt (192.168.5.6:36669)
1592744736: Socket error on client local.HomeAssistant, disconnecting.

Is there a way to avoid showing this error or maintaining the TV mqtt broker accessible?

Thanks.

ReDaLeRt · June 21, 2020, 10:20pm

This is my successful experience getting this to work, with a TV Hisense H43B7320, with its firmware version V0000.01.00a.K0117.

In: https://github.com/tiagofreire-pt/tv_hisense_home_assistant/

K-1 · June 21, 2020, 10:23pm

I dont think there is a really away to stop the connection error messages when the TV is off as basically the OS is suspended. Another option would be to get root access to the TV using the Service Port + enabling telnet then modifying the mosquitto.conf file under /3rd_rw/remoteapp/bin and setting up the bridge in the other direction. So when the TV turns on it sends the MQTT message to the homeassitant broker.

ReDaLeRt · June 22, 2020, 9:30am

@K-1, Thanks!

Do you have the pinout of that service port or any documentation that may help on that, please?

For those interested in debugging or exploring more the MQTT broker inside the TV, you can use the software MQTT Explorer (http://mqtt-explorer.com/) with these configs:

K-1 · June 22, 2020, 10:29am

Sure to connect to the service port you will need a USB to TTL UART adapter and you will need a stereo/ headphone end like one pictured in the link or below. You can buy these cheap on ebay.

Follow the guide on here. I had to reverse the TX/RX on my tv for it to work.
https://forum.xda-developers.com/showpost.php?p=68737765&postcount=84

Note to ensure telnetd is persistent after each reboot you need to add via the update script as its the only thing so far we know of that runs on each start up

Modify /3rd_rw/software-update/run-OtaUpgrade.sh

Add this to the start or end of the script:
busybox telnetd -l /bin/sh

Then connect it as follows:

I should also note that hisense sends a lot of data home. Every button pressed is sent home via HTTPS. I highly recommend blocking unified-ter-na.hismarttv.com domain if you have the capability to.

ReDaLeRt · June 22, 2020, 11:41am

Thanks, @K-1. I’ll try it.

Regarding the domain, I have pihole on my lan, and blocks it through the list https://dbl.oisd.nl/. Good catch!

ReDaLeRt · June 22, 2020, 1:08pm

For those interested, there is a chance to install HTML5 apps on these TVs:

open on TV stock browser

in the address bar, type hisense://debug

on the page type the name of the application and its URL

find the application icon in Google. copy and paste the url of the icon

Click the INSTALL button

can use the app

lots of applications here → apptest.staging.foxxum.com

In: Rooting MediaTek Based Linux Smart TV | Page 10 | XDA Forums

Could we open the local HA instance through this method?

lordw · July 3, 2020, 4:19pm

It would be great to have topics to control more things, like “picture settings”. Then you could, per example, dim the backlight or change the image mode with automations when you change your room’s lights, or depending the hour, etc. Does anyone know how to discover which topics are the TV suscribed to? All of them… it would be wonderful

K-1 · July 4, 2020, 12:26am

You inspired me to hexdump the remoteservice binary on the TV. Interestingly enough we can see all possible keys, maybe that can help someone! by the way remoteservice runs as root on the tv so if you can escape it somehow you should be able to launch telnetd to gain root access.

I wonder if you could pass on a command such as busybox telnetd -l /bin/sh by escaping it somehow?

00003cd0  4b 45 59 5f 48 4f 4d 45  00 00 00 00 4b 45 59 5f  |KEY_HOME....KEY_|
00003ce0  4d 45 4e 55 00 00 00 00  4b 45 59 5f 43 48 41 4e  |MENU....KEY_CHAN|
00003cf0  4e 45 4c 55 50 00 00 00  4b 45 59 5f 43 48 41 4e  |NELUP...KEY_CHAN|
00003d00  4e 45 4c 44 4f 57 4e 00  4b 45 59 5f 56 4f 4c 55  |NELDOWN.KEY_VOLU|
00003d10  4d 45 55 50 00 00 00 00  4b 45 59 5f 56 4f 4c 55  |MEUP....KEY_VOLU|
00003d20  4d 45 44 4f 57 4e 00 00  4b 45 59 5f 52 45 54 55  |MEDOWN..KEY_RETU|
00003d30  52 4e 53 00 4b 45 59 5f  44 4f 57 4e 00 00 00 00  |RNS.KEY_DOWN....|
00003d40  4b 45 59 5f 4c 45 46 54  00 00 00 00 4b 45 59 5f  |KEY_LEFT....KEY_|
00003d50  52 49 47 48 54 00 00 00  4b 45 59 5f 55 50 00 00  |RIGHT...KEY_UP..|
00003d60  4b 45 59 5f 4f 4b 00 00  4b 45 59 5f 30 00 00 00  |KEY_OK..KEY_0...|
00003d70  4b 45 59 5f 31 00 00 00  4b 45 59 5f 32 00 00 00  |KEY_1...KEY_2...|
00003d80  4b 45 59 5f 33 00 00 00  4b 45 59 5f 34 00 00 00  |KEY_3...KEY_4...|
00003d90  4b 45 59 5f 35 00 00 00  4b 45 59 5f 36 00 00 00  |KEY_5...KEY_6...|
00003da0  4b 45 59 5f 37 00 00 00  4b 45 59 5f 38 00 00 00  |KEY_7...KEY_8...|
00003db0  4b 45 59 5f 39 00 00 00  4b 45 59 5f 4d 55 54 45  |KEY_9...KEY_MUTE|
00003dc0  00 00 00 00 4b 45 59 5f  52 45 44 00 4b 45 59 5f  |....KEY_RED.KEY_|
00003dd0  47 52 45 45 4e 00 00 00  4b 45 59 5f 59 45 4c 4c  |GREEN...KEY_YELL|
00003de0  4f 57 00 00 4b 45 59 5f  42 4c 55 45 00 00 00 00  |OW..KEY_BLUE....|
00003df0  4b 45 59 5f 53 54 4f 50  00 00 00 00 4b 45 59 5f  |KEY_STOP....KEY_|
00003e00  50 4c 41 59 00 00 00 00  4b 45 59 5f 50 41 55 53  |PLAY....KEY_PAUS|
00003e10  45 00 00 00 4b 45 59 5f  42 41 43 4b 53 00 00 00  |E...KEY_BACKS...|
00003e20  4b 45 59 5f 46 4f 52 57  41 52 44 53 00 00 00 00  |KEY_FORWARDS....|
00003e30  4b 45 59 5f 50 52 45 56  49 4f 55 53 00 00 00 00  |KEY_PREVIOUS....|
00003e40  4b 45 59 5f 4e 45 58 54  00 00 00 00 4b 45 59 5f  |KEY_NEXT....KEY_|
00003e50  43 48 41 4e 4e 45 4c 44  4f 54 00 00 4b 45 59 5f  |CHANNELDOT..KEY_|
00003e60  43 48 41 4e 4e 45 4c 4c  49 4e 45 00 4b 45 59 5f  |CHANNELLINE.KEY_|
00003e70  52 45 43 4f 52 44 00 00  4b 45 59 5f 43 43 00 00  |RECORD..KEY_CC..|
00003e80  4b 45 59 5f 4d 54 53 00  4b 45 59 5f 45 58 49 54  |KEY_MTS.KEY_EXIT|
00003e90  00 00 00 00 4b 45 59 5f  50 4f 57 45 52 00 00 00  |....KEY_POWER...|
00003ea0  4b 45 59 5f 45 50 47 00  4b 45 59 5f 50 56 52 00  |KEY_EPG.KEY_PVR.|
00003eb0  4b 45 59 5f 54 49 4d 45  53 48 49 46 54 00 00 00  |KEY_TIMESHIFT...|
00003ec0  4b 45 59 5f 54 58 54 00  4b 45 59 5f 53 55 42 54  |KEY_TXT.KEY_SUBT|
00003ed0  49 54 4c 45 00 00 00 00  4b 45 59 5f 4c 41 4e 47  |ITLE....KEY_LANG|
00003ee0  55 41 47 45 00 00 00 00  4c 69 74 5f 54 41 42 00  |UAGE....Lit_TAB.|
00003ef0  4c 69 74 5f 43 41 50 00  4c 69 74 5f 53 48 49 46  |Lit_CAP.Lit_SHIF|
00003f00  54 00 00 00 4c 69 74 5f  53 50 41 43 45 00 00 00  |T...Lit_SPACE...|
00003f10  4c 69 74 5f 43 54 52 4c  00 00 00 00 4c 69 74 5f  |Lit_CTRL....Lit_|
00003f20  41 4c 54 00 4c 69 74 5f  45 4e 54 45 52 00 00 00  |ALT.Lit_ENTER...|
00003f30  4c 69 74 5f 44 45 4c 45  54 45 00 00 4c 69 74 5f  |Lit_DELETE..Lit_|
00003f40  42 41 43 4b 53 50 41 43  45 00 00 00 4c 69 74 5f  |BACKSPACE...Lit_|
00003f50  45 53 43 00 4c 69 74 5f  49 4e 53 45 52 54 00 00  |ESC.Lit_INSERT..|
00003f60  4c 69 74 5f 48 4f 4d 45  00 00 00 00 4c 69 74 5f  |Lit_HOME....Lit_|
00003f70  45 4e 44 00 4c 69 74 5f  50 55 00 00 4c 69 74 5f  |END.Lit_PU..Lit_|
00003f80  50 44 00 00 4c 69 74 5f  4c 45 46 54 00 00 00 00  |PD..Lit_LEFT....|
00003f90  4c 69 74 5f 52 49 47 48  54 00 00 00 4c 69 74 5f  |Lit_RIGHT...Lit_|
00003fa0  55 50 00 00 4c 69 74 5f  44 4f 57 4e 00 00 00 00  |UP..Lit_DOWN....|
00003fb0  4c 69 74 5f 46 31 00 00  4c 69 74 5f 46 32 00 00  |Lit_F1..Lit_F2..|
00003fc0  4c 69 74 5f 46 33 00 00  4c 69 74 5f 46 34 00 00  |Lit_F3..Lit_F4..|
00003fd0  4c 69 74 5f 46 35 00 00  4c 69 74 5f 46 36 00 00  |Lit_F5..Lit_F6..|
00003fe0  4c 69 74 5f 46 37 00 00  4c 69 74 5f 46 38 00 00  |Lit_F7..Lit_F8..|
00003ff0  4c 69 74 5f 46 39 00 00  61 00 00 00 62 00 00 00  |Lit_F9..a...b...|
00004000  63 00 00 00 64 00 00 00  65 00 00 00 66 00 00 00  |c...d...e...f...|
00004010  67 00 00 00 68 00 00 00  69 00 00 00 6a 00 00 00  |g...h...i...j...|
00004020  6b 00 00 00 6c 00 00 00  6d 00 00 00 6e 00 00 00  |k...l...m...n...|
00004030  6f 00 00 00 70 00 00 00  71 00 00 00 72 00 00 00  |o...p...q...r...|
00004040  73 00 00 00 74 00 00 00  75 00 00 00 76 00 00 00  |s...t...u...v...|
00004050  77 00 00 00 78 00 00 00  79 00 00 00 7a 00 00 00  |w...x...y...z...|
00004060  41 00 00 00 42 00 00 00  43 00 00 00 44 00 00 00  |A...B...C...D...|
00004070  45 00 00 00 46 00 00 00  47 00 00 00 48 00 00 00  |E...F...G...H...|
00004080  49 00 00 00 4a 00 00 00  4b 00 00 00 4c 00 00 00  |I...J...K...L...|
00004090  4d 00 00 00 4e 00 00 00  4f 00 00 00 50 00 00 00  |M...N...O...P...|
000040a0  51 00 00 00 52 00 00 00  53 00 00 00 54 00 00 00  |Q...R...S...T...|
000040b0  55 00 00 00 56 00 00 00  57 00 00 00 58 00 00 00  |U...V...W...X...|
000040c0  59 00 00 00 5a 00 00 00  30 00 00 00 31 00 00 00  |Y...Z...0...1...|
000040d0  32 00 00 00 33 00 00 00  34 00 00 00 35 00 00 00  |2...3...4...5...|
000040e0  36 00 00 00 37 00 00 00  38 00 00 00 39 00 00 00  |6...7...8...9...|
000040f0  54 41 42 00 43 41 50 00  53 48 49 46 54 00 00 00  |TAB.CAP.SHIFT...|
00004100  53 50 41 43 45 00 00 00  43 54 52 4c 00 00 00 00  |SPACE...CTRL....|
00004110  41 4c 54 00 45 4e 54 45  52 00 00 00 44 45 4c 45  |ALT.ENTER...DELE|
00004120  54 45 00 00 42 41 43 4b  53 50 41 43 45 00 00 00  |TE..BACKSPACE...|
00004130  7b 00 00 00 7d 00 00 00  3b 00 00 00 27 00 00 00  |{...}...;...'...|
00004140  2c 00 00 00 2e 00 00 00  2f 00 00 00 5c 00 00 00  |,......./...\...|
00004150  2b 00 00 00 7e 00 00 00  45 53 43 00 49 4e 53 45  |+...~...ESC.INSE|
00004160  52 54 00 00 48 4f 4d 45  00 00 00 00 45 4e 44 00  |RT..HOME....END.|
00004170  50 55 00 00 50 44 00 00  4c 45 46 54 00 00 00 00  |PU..PD..LEFT....|
00004180  52 49 47 48 54 00 00 00  55 50 00 00 44 4f 57 4e  |RIGHT...UP..DOWN|
00004190  00 00 00 00 46 31 00 00  46 32 00 00 46 33 00 00  |....F1..F2..F3..|
000041a0  46 34 00 00 46 35 00 00  46 36 00 00 46 37 00 00  |F4..F5..F6..F7..|
000041b0  46 38 00 00 46 39 00 00  5f 00 00 00 3d 00 00 00  |F8..F9.._...=...|
000041c0  7c 00 00 00 3a 00 00 00  22 00 00 00 3c 00 00 00  ||...:..."...<...|
000041d0  3e 00 00 00 3f 00 00 00  21 00 00 00 23 00 00 00  |>...?...!...#...|
000041e0  24 00 00 00 25 00 00 00  5e 00 00 00 26 00 00 00  |$...%...^...&...|
000041f0  2a 00 00 00 28 00 00 00  29 00 00 00 40 00 00 00  |*...(...)...@...|
00004200  5b 00 00 00 5d 00 00 00  e2 82 a9 00 ef bf a5 00  |[...]..

lordw · July 4, 2020, 3:27pm

Nice finding! Perhaps you could have a look at other binaries like the one for platform_service, which receives commands like “changevolume” or “getvolume”. It would be great if there were other capabilities hidden.

lindsayward · July 9, 2020, 1:08pm

@Alex-M-GitHub - thanks for your work and publishing something installable.
I contributed early to this thread but haven’t really needed anything beyond just being interested.
Now I have a need to set the source (to HDMI2) on my TV using a script.
How far off being able to do this with your custom component are we/you?