TiVo Community Forum banner
  • TiVoCommunity.com Ambassador Program Now Open! >>> Click Here

TiVo UI Control via Telnet - No Hacking Required!

505K views 818 replies 221 participants last post by  Patrick2050 
#1 ·
As many of you may have already heard, TiVo added support for Crestron systems back in software version 9.1 but there isn't a whole lot of information available about from TiVo or from Crestron.

After thinking about it for a small while, my curiosity was piqued, and I decided to try and figure out the protocol Crestron was using to talk to an unhacked TiVo, and how we non-Crestron users could somehow harness it.

As it turns out both the TiVo HD and Series3 units now listen on port 31339 for connections from a Crestron device. What is really interesting about this discovery is that this service is enabled and accessible by default on a stock Series3 running software 9.1 and up. There is NO HACKING REQUIRED to use this interface.

The protocol and its commands aren't published, but some heavy digging on Crestron and debugging the tivoapp binary resulted in some interested finds.

If you telnet into your TiVo on port 31339, you will be presented with the following:

Code:
CH_STATUS <CHANNEL> <STATUS>
This prompt reflects the current status of the TiVo and will tell you the current channel being watched, and if it's being recorded.

Once the telnet session is started, the following commands are available:

KEYBOARD - The current purpose and syntax of this command is unknown.

TELEPORT <PLACE>- I'm not sure why this command exists, because I believe anything that TELEPORT does can also be accomplished via IRCODE. That said, the four currently known places you can "teleport" to are TIVO, LIVETV, GUIDE, and NOWPLAYING.

SETCH <CHANNEL> - This command will change the channel on the current tuner being watched to the channel number defined. If the current tuner is recording a program, it will change the other tuner. If both tuners are recording, the channel will not change and the TiVo will respond with "CH_FAILED RECORDING "Show Title". Using this command when a recording is being played back will result in "CH_FAILED NO_LIVE".

FORCECH <CHANNEL> - This command will force the current tuner to the tune the desired channel regardless of what it's doing. If a recording is being recorded it will cancel the recording and change the channel without confirmation.

IRCODE <COMMAND> - IRCODE seems to mimic the old "sendkey" command in almost every way. While it can't handle multiple commands on one line, almost all of the commands listed in sendkey.tcl are valid and working.

The following is a list of IRCODE commands that I have verified as working:

Code:
UP
DOWN
LEFT
RIGHT
SELECT
TIVO
LIVETV
THUMBSUP
THUMBSDOWN
CHANNELUP
CHANNELDOWN
RECORD
DISPLAY
DIRECTV
NUM0
NUM1
NUM2
NUM3
NUM4
NUM5
NUM6
NUM7
NUM8
NUM9
ENTER
CLEAR
PLAY
PAUSE
SLOW
FORWARD
REVERSE
STANDBY
NOWSHOWING
REPLAY
ADVANCE
DELIMITER
GUIDE
If take too long to type a command, it will result in COMMAND_TIMEOUT since the interface was designed to receive whole and complete commands, and was not designed to be used manually via telnet.

That's all I've found for now, but I'll be sure to post updates as they come along.
 
See less See more
#697 ·
You can get free certificates from here: Let's Encrypt - Free SSL/TLS Certificates (that might reduce complexity vs. a self-signed one)

Your server would need to be publicly accessible though, but it looks like that's a requirement anyway for Alexa.
Yeah, that's what I'm doing myself but other people trying out my Alexa skill don't necessarily have their own domain and thus need to try self-signed certificates uploaded to the Alexa Developer site.

I've been playing around with Home Assistant today and have it pretty much working at home. It's neat as a centralized monitor and there are a lot of components to explore. I haven't gotten to the Alexa/Hue portion yet. All that being said, I don't think setting up HASS is any less complicated than the other hoops you have to jump through to get the TiVo Control skill working in the first place ... but I was able to get the Lambda HTTPS proxy function working (that I found reading about HASS), so that's another possible alternative.
 
#699 ·
I just got started on my THR22 Alexa skill. I need to look at this "Home Assistant" you guys are talking about. I don't really want to use the automation type, because then you have to create a Lambda function on AWS which is not free. Using a custom skill I have to say "Alexa, tell tivo living room put on BBC America" I have two tivos that are controllable through the one Alexa skill. It would be nice if there were some way to tell which Alexa device is making the request, then I could set living room or bedroom as the default for the device to eliminate extra words.

The next step is to make it search. Has anyone tried something like "TELEPORT TIVOCENTRAL, IRCODE UP UP UP UP UP RIGHT RIGHT, KEYBOARD blahblahblah" to get to the search? I'm just trying to avoid failure if people know it won't work or is really slow etc. Once I get it done, I'll share the code. Though it does require an outwardly facing web server running PHP.
 
#701 ·
The next step is to make it search. Has anyone tried something like "TELEPORT TIVOCENTRAL, IRCODE UP UP UP UP UP RIGHT RIGHT, KEYBOARD blahblahblah" to get to the search?
I have this working in my skill ... I can say "Alexa, tell TiVo to search for <phrase>" and it will go to the Search screen and type in the phrase. I'm using the AMAZON.Movie and AMAZON.TVSeries slot types, but most other phrases seem to work.
 
#703 ·
I have this working in my skill ... I can say "Alexa, tell TiVo to search for <phrase>" and it will go to the Search screen and type in the phrase. I'm using the AMAZON.Movie and AMAZON.TVSeries slot types, but most other phrases seem to work.
I've added that sort of interaction to my interface too. Similar wording too. But I'm just using the TVSeries type, how to I define a double typed slot? I noticed that just using TVSeries, it doesn't do well with "four weddings and a funeral". I end up getting a 4 rather than "four" Do the types know if the number should be written out vs numeric form?
 
#704 ·
The slot types should be able to match the phrase, so yeah, AMAZON.Movie should match "Four Weddings and a Funeral." If you're just using AMAZON.TVSeries, I would expect what you're describing above.

The contributor to my GitHub project who helped with the Search utterance had to make a change to alexa-utterances to allow for optional slot types, which let us do this:

Code:
app.intent('Search',
{
"slots":{"TIVOSEARCHREQMOVIE":"AMAZON.Movie","TIVOSEARCHREQTVSERIES":"AMAZON.TVSeries"},
"utterances":[ "{go to|to|open|open up|display|launch|show|} {search|find} {for +TIVOSEARCHREQMOVIE+|+TIVOSEARCHREQMOVIE+|for +TIVOSEARCHREQTVSERIES+|+TIVOSEARCHREQTVSERIES+|}" ]
}
So that lets us use the TV and Movie slot types in the same utterance, they're just optional so the skill will try to match the utterance to either slot.
 
#706 ·
Just another idea for those fiddling with alexa-tivo-app... after getting it working directly by poking a hole in my home router (and hating the security exposure) I decided on a different path. I broke the app into two components: one a Lambda function (where most of the work is) that puts the TIVO commands on an SQS queue, and one a daemon running on my home PC that listens to the queue and merely telnets the commands to the Tivo locally. Security problem solved!

Most of the work is in the sendCommand and sendNextCommand functions of alexa-tivo-app - adjusting the logic to talk to SQS on the lambda side.

And yes - SQS queue is free too for first million requests. Utilize a 20-second polling timeout (the max allowed) and you're only calling it 134K times/month. You can tell your tivo do to ~400K things in a month for free.
 
#708 ·
Hey, just saw this, sorry. I'm a total open source noob so I have no idea even how to post mods or branch a repo; maybe I can just send you the source. You will likely recognize it, I literally just did a cut and paste hatchet job to get it working :)

As a former C++ dev, I should be embarrassed by the state of it (and lack of error handling, etc.) but I (a) don't know node.js and (b) have zero time to learn! I'm just happy to get it working. PM me if interested.
 
#709 ·
Hey, just saw this, sorry. I'm a total open source noob so I have no idea even how to post mods or branch a repo; maybe I can just send you the source. You will likely recognize it, I literally just did a cut and paste hatchet job to get it working :)
No worries ... I was totally new to GitHub as well which is one of the reasons I started messing around with it and the Alexa skill at the same time ... learned how to fork someone else's project (he had started it and it seemed like no work had been done on it) and then added and enhanced from there. If you want to PM me the source changes I'd like to look at it just for curiosity's sake. Plus maybe it's another good option for folks who can't run a node-js server over HTTPS at home.
 
#710 · (Edited)
I understand that this is an older thread. I was wondering if anyone had any recent success in using telnet to send commands to the Bolt? I am unable to connect using the port 31339. The network remote option was turned on. I get the message connection failed. I was hoping to use this method to enter a longer wireless network password. Any feedback would be appreciated.
 
#711 · (Edited)
Not exactly clear on what you're asking but the telnet interface does still work (even on the Bolt). For example, you should be able to 'telnet <your Bolt's IP address> 31339' and then issue 'IRCODE PAUSE' or 'TELEPORT TIVO'. To do a password, you'd have to send a series of KEYBOARD commands for the individual letters (you can't send a string) so it'd look like:

Code:
KEYBOARD LSHIFT
KEYBOARD P
KEYBOARD A
KEYBOARD S
KEYBOARD S
KEYBOARD W
KEYBOARD O
KEYBOARD R
KEYBOARD D
Note you have to send an LSHIFT command before a letter that needs to be upper-case. So in my example above, the word would be 'Password'.
 
#712 ·
Sorry, speech recognition is poor. I am using Win 10 and believe the syntax is a bit different. I assume that I have to first establish a connection before I can issue a command. what do you think I am missing?

telnet 192.168.1.104:31339
Connecting To 192.168.1.104:31339...Could not open connection to the host, on port 23: Connect failed

telnet 192.168.1.104 31339
Connecting To 192.168.1.104...Could not open connection to the host, on port 31339: Connect failed

Not exactly clear on what you're asking but the telnet interface does still work (even on the Bolt). For example, you should be able to 'telnet <your Bolt's IP address>:31339' and then issue 'IRCODE PAUSE' or 'TELEPORT TIVO'. To do a password, you'd have to send a series of KEYBOARD commands for the individual letters (you can't send a string) so it'd look like:

Code:
KEYBOARD LSHIFT
KEYBOARD P
KEYBOARD A
KEYBOARD S
KEYBOARD S
KEYBOARD W
KEYBOARD O
KEYBOARD R
KEYBOARD D
Note you have to send an LSHIFT command before a letter that needs to be upper-case. So in my example above, the word would be 'Password'.
 
#717 ·
GOT IT! I suspect this may had something to do with my range extender that I was using for a physical ethernet connection. Using up all the windows XP computer, a different wireless router and wiring everything directly I am now able to connect with the Bolt via telnet. Thanks everyone!
 
#718 ·
I got to learn a few things today. I've learned how to use a script to input into Telnet (eg. WshShell.SendKeys ("KEYBOARD A") ). I am having trouble with the command to have a capital letter. using the example above:

KEYBOARD LSHIFT
KEYBOARD P

does not end up getting me a capital P, it seems that lshift is ignored. The way it is written it looks like two separate commands: KEYBOARD LSHIFT (enter) AND KEYBOARD P (enter). I am not sure what I'm doing wrong.

also can someone help me with what the keyboard command is for @ and ~


Thanks!
 
#720 · (Edited)
So I've been trying to use the telnet commands to control several Tivos minis at my work. Each Tivo mini is set up to show a different news channel (like a news-video-wall). 5 Different minis, 5 different channels. To this end, I have a Windows laptop that runs 5 different task-scheduler tasks. Those 5 tasks each run a batch file every half hour that opens the telnet software, and then runs a .txt file that looks like this:
192.168.1.[# of Tivo IP] 31339
SEND "IRCODE NUM2\m IRCODE Num0\m
and this will make sure that each tivo is on the right channel (channel 20 in the example above).

Here's my problem. After one batch file runs, the telnet software remains open, preventing the next batch file from running properly. The telnet window must be closed first before it can be called again for the next Tivo. I've worked around this by scheduling another tast which runs TaskKill. That action looks like: "TASKKILL /F /IM "TST10.exe". That task runs every 2 minutes. And the Telnet tasks run 5 minutes apart so the TaskKill has time to close the previous Telnet open dialog box.
It's very inelegant.
What I'd like to do, is have a single task that opens telnet, changes the channel, waits, then closes the operation (TaskKill), then waits again for a few seconds, and does that for all 5 Tivos. I've had a lot of problems trying to get this to work.
If anyone knows alot about these things and can see how I can do this, I would really appreciate any feedback or suggestions.
 
#724 ·
So I've been trying to use the telnet commands to control several Tivos minis at my work. Each Tivo mini is set up to show a different news channel (like a news-video-wall). 5 Different minis, 5 different channels. To this end, I have a Windows laptop that runs 5 different task-scheduler tasks. Those 5 tasks each run a batch file every half hour that opens the telnet software, and then runs a .txt file that looks like this:
192.168.1.[# of Tivo IP] 31339
SEND "IRCODE NUM2\m IRCODE Num0\m
and this will make sure that each tivo is on the right channel (channel 20 in the example above).

Here's my problem. After one batch file runs, the telnet software remains open, preventing the next batch file from running properly. The telnet window must be closed first before it can be called again for the next Tivo. I've worked around this by scheduling another tast which runs TaskKill. That action looks like: "TASKKILL /F /IM "TST10.exe". That task runs every 2 minutes. And the Telnet tasks run 5 minutes apart so the TaskKill has time to close the previous Telnet open dialog box.
It's very inelegant.
What I'd like to do, is have a single task that opens telnet, changes the channel, waits, then closes the operation (TaskKill), then waits again for a few seconds, and does that for all 5 Tivos. I've had a lot of problems trying to get this to work.
If anyone knows alot about these things and can see how I can do this, I would really appreciate any feedback or suggestions.
You would need to be able to send a Ctrl-], then a C (Close) if you are using the old Windows telnet program.
 
#725 · (Edited)
So I've been trying to use the telnet commands to control several Tivos minis at my work. Each Tivo mini is set up to show a different news channel (like a news-video-wall). 5 Different minis, 5 different channels. To this end, I have a Windows laptop that runs 5 different task-scheduler tasks. Those 5 tasks each run a batch file every half hour that opens the telnet software, and then runs a .txt file that looks like this:
192.168.1.[# of Tivo IP] 31339
SEND "IRCODE NUM2\m IRCODE Num0\m
and this will make sure that each tivo is on the right channel (channel 20 in the example above).

Here's my problem. After one batch file runs, the telnet software remains open, preventing the next batch file from running properly. The telnet window must be closed first before it can be called again for the next Tivo. I've worked around this by scheduling another tast which runs TaskKill. That action looks like: "TASKKILL /F /IM "TST10.exe". That task runs every 2 minutes. And the Telnet tasks run 5 minutes apart so the TaskKill has time to close the previous Telnet open dialog box.
It's very inelegant.
What I'd like to do, is have a single task that opens telnet, changes the channel, waits, then closes the operation (TaskKill), then waits again for a few seconds, and does that for all 5 Tivos. I've had a lot of problems trying to get this to work.
If anyone knows alot about these things and can see how I can do this, I would really appreciate any feedback or suggestions.
This is mainly for windows telnet client.
Not sure what editor you are using for your text file but per ThAbtO suggestion add to your text file:
Code:
Ctrl-] (usually can add by holding the Alt key down and type on the number pad 029.  Make sure num lock is on so you get numbers.  This will not work with the number keys across the top of the keyboard)
c      (closes the connection)
q     (quits telnet)
Alternatively you can set a different escape code. You can do this by using the set command before you open up the telnet connection.
Code:
 set escape x (where x is the character you want to use.  Make sure it is unused in your script file)
so maybe a script like this:
Code:
set escape =
o 192.168.1.[# of TiVo IP] 33139
SEND "IRCODE NUM2\m IRCODE Num0\m
=
c
q
 
#727 ·
Guys, I have a Tivo bolt, I need to know if there is a way to turn the internal SDV on, My cable company only deals with their own branded Tivos, and refuse to pair this TiVo correctly, is there a way for me to activate the internal SDV control On my bolt? at any rate any help or insight will be greatly appreciated.
regards

Jack
 
#732 · (Edited)
If you are on comcast, they do not yet use Tuning adapters, but most does. It is a separate device which work in conjunction to a cable card. (cable boxes have both built within.) It is controlled by the Tivo through the USB port.

Tivos do not have built-in tuning adapters, only the support for them, hence the tuning adapter menu for setting up.

It looks like you are in Canada and US Tivos are not compatible with most services in Canada.
 
#733 · (Edited)
This is an older thread, you may not receive a response, and could be reviving an old thread. Please consider creating a new thread.
Top