TiVo UI Control via Telnet - No Hacking Required!

Omikron · 04-30-2008, 10:36 PM

As many of you may have already heard, TiVo added support for Crestron systems back in software version 9.1 but there isn't a whole lot of information available about from TiVo or from Crestron.

After thinking about it for a small while, my curiosity was piqued, and I decided to try and figure out the protocol Crestron was using to talk to an unhacked TiVo, and how we non-Crestron users could somehow harness it.

As it turns out both the TiVo HD and Series3 units now listen on port 31339 for connections from a Crestron device. What is really interesting about this discovery is that this service is enabled and accessible by default on a stock Series3 running software 9.1 and up. There is NO HACKING REQUIRED to use this interface.

The protocol and its commands aren't published, but some heavy digging on Crestron and debugging the tivoapp binary resulted in some interested finds.

If you telnet into your TiVo on port 31339, you will be presented with the following:

Code:

CH_STATUS <CHANNEL> <STATUS>

This prompt reflects the current status of the TiVo and will tell you the current channel being watched, and if it's being recorded.

Once the telnet session is started, the following commands are available:

KEYBOARD - The current purpose and syntax of this command is unknown.

TELEPORT <PLACE>- I'm not sure why this command exists, because I believe anything that TELEPORT does can also be accomplished via IRCODE. That said, the four currently known places you can "teleport" to are TIVO, LIVETV, GUIDE, and NOWPLAYING.

SETCH <CHANNEL> - This command will change the channel on the current tuner being watched to the channel number defined. If the current tuner is recording a program, it will change the other tuner. If both tuners are recording, the channel will not change and the TiVo will respond with "CH_FAILED RECORDING "Show Title". Using this command when a recording is being played back will result in "CH_FAILED NO_LIVE".

FORCECH <CHANNEL> - This command will force the current tuner to the tune the desired channel regardless of what it's doing. If a recording is being recorded it will cancel the recording and change the channel without confirmation.

IRCODE <COMMAND> - IRCODE seems to mimic the old "sendkey" command in almost every way. While it can't handle multiple commands on one line, almost all of the commands listed in sendkey.tcl are valid and working.

The following is a list of IRCODE commands that I have verified as working:

Code:

UP
DOWN
LEFT
RIGHT
SELECT
TIVO
LIVETV
THUMBSUP
THUMBSDOWN
CHANNELUP
CHANNELDOWN
RECORD
DISPLAY
DIRECTV
NUM0
NUM1
NUM2
NUM3
NUM4
NUM5
NUM6
NUM7
NUM8
NUM9
ENTER
CLEAR
PLAY
PAUSE
SLOW
FORWARD
REVERSE
STANDBY
NOWSHOWING
REPLAY
ADVANCE
DELIMITER
GUIDE

If take too long to type a command, it will result in COMMAND_TIMEOUT since the interface was designed to receive whole and complete commands, and was not designed to be used manually via telnet.

That's all I've found for now, but I'll be sure to post updates as they come along.

Omikron · 04-30-2008, 10:37 PM

[reserved Post]

bdraw · 05-01-2008, 10:39 AM

Wow, nice job!

Now why they hell didn't I ever think of that?
I just tried it and it works great, now we just need to figure out how to query information like current channel, current recording etc.

tivoupgrade · 05-01-2008, 11:29 AM

That is a really interesting discovery. Just played around with it a bit on one of my Series3 and it was simple and straightforward. Would be really interesting to see what additional information emerges and how this could be applied.

Perhaps a JAVA application to remotely control the TiVo?

Perhaps a TiVoWebPlus module would give folks in 'hybrid' environments the ability to remotely control unhacked TiVos in their environment?

Could be fodder for a 'bounty' somewhere down the line?

Lou

StanSimmons · 05-01-2008, 11:50 AM

Quote:

Originally Posted by tivoupgrade

That is a really interesting discovery. Just played around with it a bit on one of my Series3 and it was simple and straightforward. Would be really interesting to see what additional information emerges and how this could be applied.

Perhaps a JAVA application to remotely control the TiVo?

Perhaps a TiVoWebPlus module would give folks in 'hybrid' environments the ability to remotely control unhacked TiVos in their environment?

Could be fodder for a 'bounty' somewhere down the line?

Lou

It works on prom-hacked TiVoHD's too.

Omikron · 05-01-2008, 12:08 PM

It would appear that the <STATUS> field has 3 states: LOCAL, REMOTE, and RECORDING

It would appear so far that LOCAL refers to the current tuner being watched, REMOTE refers to the tuner not being watched, and RECORDING means that the current tuner is recording.

Can someone do some testing and confirm or refute this?

Omikron · 05-01-2008, 12:53 PM

Quote:

Originally Posted by bdraw

Wow, nice job!

Now why they hell didn't I ever think of that?
I just tried it and it works great, now we just need to figure out how to query information like current channel, current recording etc.

The current channel is automatically reported back anytime you connect or anytime the channel changes.

StanSimmons · 05-01-2008, 01:40 PM

interesting datapoint:

Quote:

SETCH 333
CH_FAILED INVALID_CHANNEL

333 is an invalid channel.

StanSimmons · 05-01-2008, 01:44 PM

Quote:

Originally Posted by Omikron

It would appear that the <STATUS> field has 3 states: LOCAL, REMOTE, and RECORDING

It would appear so far that LOCAL refers to the current tuner being watched, REMOTE refers to the tuner not being watched, and RECORDING means that the current tuner is recording.

Can someone do some testing and confirm or refute this?

That looks to be the case:

Quote:

SETCH 357
CH_STATUS 0357 REMOTE
CH_STATUS 0357 LOCAL
IRCODE CHANNELUP
CH_STATUS 0363 LOCAL
SETCH 357
CH_STATUS 0357 REMOTE

Omikron · 05-01-2008, 02:23 PM

Quote:

Originally Posted by StanSimmons

interesting datapoint:

333 is an invalid channel.

I assume your TiVo doesn't have access to channel 333? It works fine on mine.

That said, here are some other possible responses I pulled from tivoapp:

Code:

INVALID_KEY
INVALID_COMMAND
MISSING_TELEPORT_NAME
CH_FAILED
MISSING_CHANNEL
MALFORMED_CHANNEL
LIVETV_READY
NO_LIVE
INVALID_CHANNEL
COMMAND_TIMEOUT

windracer · 05-01-2008, 02:25 PM

/subscribe

Pretty cool stuff!

I could really mess with my wife in the other room this way.

davezatz · 05-01-2008, 02:40 PM

Awesome find. I linked this thread and shot a quick video demo using my iPhone as a TiVo WiFi remote. Tons of potential here...

http://www.youtube.com/watch?v=HUPy-DPaXec

StanSimmons · 05-01-2008, 02:52 PM

Quote:

Originally Posted by Omikron

I assume your TiVo doesn't have access to channel 333? It works fine on mine.

333 is not an active channel on my setup.

Omikron · 05-01-2008, 02:53 PM

Quote:

Originally Posted by StanSimmons

333 is not an active channel on my setup.

Well then that makes sense. ;-)

WinBear · 05-01-2008, 03:28 PM

You could "page" the person watching the TiVo in another part of the house by sending a pause, a thumbs up, and a thumbs down or something like that.

Omikron · 05-01-2008, 03:35 PM

Quote:

Originally Posted by WinBear

You could "page" the person watching the TiVo in another part of the house by sending a pause, a thumbs up, and a thumbs down or something like that.

That...would be incredibly lazy! ;-)

I imagine in most houses where such a feature would be remotely useful are already big enough where they have an intercom system installed.

PaulS · 05-01-2008, 03:42 PM

/subscribe

Really cool stuff!

Pumping commands through CURL would probably avoid the problems of having the commands time-out.

Paired with some guide data, you could completely replace the TiVo's own scheduling functionality with a PC-based version. Redundant, but interesting.

KRKeegan · 05-01-2008, 03:57 PM

I am very interested in seeing how this develops. I agree with the general sentiment that there is probably some nice functionality that could be built using this, but I can't think of one yet.

Omikron · 05-01-2008, 04:11 PM

Quote:

Originally Posted by KRKeegan

I am very interested in seeing how this develops. I agree with the general sentiment that there is probably some nice functionality that could be built using this, but I can't think of one yet.

Well, the only functionality I can think of is just TiVo control over TCP/IP which is exactly what it was designed for. The main advantage here is that we are now able to create our own interfaces for it. I imagine it won't be long before someone develops a small iPhone app that mimics TivoWebPlus's WebRemote module.

Some might also be interested in a Mac OS X Widget or a Windows Vista Gadget that does the same.

enthalpy · 05-01-2008, 04:35 PM

Nice. This makes so much sense. I can't wait to get home and try it.

But telnet? Will ssh work? telnet is so out of favor due to lack of security. My Nokia N810 doesn't have telnet built in.

ashu · 05-01-2008, 04:37 PM

Wait ... CoOperative Scheduling (between multiple HD/S3 TiVos), perchance!?

Assuming access to the SP list, ToDo List et al can be wrangled. I don't see it yet in the above 'discovered' (?) set of commands

enthalpy · 05-01-2008, 04:38 PM

Quote:

Originally Posted by Omikron

That...would be incredibly lazy! ;-)

I imagine in most houses where such a feature would be remotely useful are already big enough where they have an intercom system installed.

Oh, I know: instead of "I've fallen and I can't get up", I can send a SETCH 911, and if my girlfriend sees that the TV is tuned to 911, she'll know that's there's an emergency. ;-)

Omikron · 05-01-2008, 04:55 PM

Quote:

Originally Posted by enthalpy

Nice. This makes so much sense. I can't wait to get home and try it.

But telnet? Will ssh work? telnet is so out of favor due to lack of security. My Nokia N810 doesn't have telnet built in.

SSH would definitely not work. In fact, I believe the actual protocol being used is RAW but Telnet is pretty darn close so that works too.

There is no security involved in this because, again, it's just remote control over TCP/IP. There is absolutely no reason to complicate matters by introducing authentication or encryption.

StanSimmons · 05-01-2008, 05:10 PM

Quote:

Originally Posted by Omikron

SSH would definitely not work. In fact, I believe the actual protocol being used is RAW but Telnet is pretty darn close so that works too.

There is no security involved in this because, again, it's just remote control over TCP/IP. There is absolutely no reason to complicate matters by introducing authentication or encryption.

Perhaps nc (netcat) should be used instead of telnet then. Or puTTY on Windows....

Omikron · 05-01-2008, 05:16 PM

Quote:

Originally Posted by StanSimmons

Perhaps nc (netcat) should be used instead of telnet then. Or puTTY on Windows....

If I recall correctly warewolf tried using netcat and it locked up the TiVo UI. puTTY works fine in RAW mode.

PaulS · 05-01-2008, 06:04 PM

Quote:

Originally Posted by ashu

Wait ... CoOperative Scheduling (between multiple HD/S3 TiVos), perchance!?

Assuming access to the SP list, ToDo List et al can be wrangled. I don't see it yet in the above 'discovered' (?) set of commands

Probably won't see it either.

However, that doesn't rule out co-operative scheduling. You'd probably have to hand over complete recording and scheduling control to the computer, though. In order to ensure that the TiVo and computer wouldn't try to start conflicting or over-lapping programs, the computer would likely have to have complete control. That means no SeasonPasses or ARWL's on the TiVo's.

You'd have to modify a computer application that had access to guide data (MythTV or something similar) so that it would emit telnet commands to one of your TiVo's, rather than try to record the program direct to disk with a tuner. You'd then additionally have to feed it a list of usable TiVo's to use (including how many tuners they have), as well as a list of programs to record (similar to a Season Pass Manager).

So, it's possible, but would be a significant bit of work...

Jasoco · 05-01-2008, 06:47 PM

Am I doing something wrong?

I'm on OS X. I open up my Terminal and type "telnet". I get the prompt.

>

What do I do from here? I try typing "open" and it asks for an IP. So I type "192.168.1.108:31339". Am I typing that wrong? 192.168.1.108 is my IP on my LAN, 31339 is the port. But it says "nodename nor servname provided, or not known".

If I leave off the port number it sits there "trying".

What exactly am I supposed to do? Do I have to turn something on first? Do I need to open a port on my router?

ThAbtO · 05-01-2008, 06:54 PM

I was able to use this on my THD and if I sent 'SETCH 4' it switches to ch 4, while 'SETCH 4 3' goes to ch 4.3, but when I tried to use a period or dash to set the digital channel and that didn't work.

FYI, This didn't work for the S2 though.

ThAbtO · 05-01-2008, 06:57 PM

Quote:

Originally Posted by Jasoco

What do I do from here? I try typing "open" and it asks for an IP. So I type "192.168.1.108:31339". Am I typing that wrong? 192.168.1.108 is my IP on my LAN, 31339 is the port. But it says "nodename nor servname provided, or not known".

If I leave off the port number it sits there "trying".

What exactly am I supposed to do? Do I have to turn something on first? Do I need to open a port on my router?

Try using a space instead of a colon ':'

PaulS · 05-01-2008, 07:01 PM

Crestron has a page up about this "module" of theirs. You need to have a login to download the module, but they do have a screen shot, which should illustrate the functions that are currently supported :

Looks like most of the bases have already been covered, but not all of them. For instance, the Crestron image shows an "aspect" and an "info" control.