Brute force Fire TV IR codes

Infrared Transceiver
#1

Before anyone tells me I’m an idiot like someone on another forum implied… Fire TV can use Bluetooth or infrared as long as they have an IR receiver. According to FLIRC you can even add a USB IR receiver. I don’t know if my codes work on all the Fire TV devices. I’ll put a couple code in here if anyone wants to test it.

Just received my Flipper zero and decided to start small so I began with IR. I wrote a python script that outputs a file format meant to replace the tv.ir universal remote file. The flipper then scans through and sends the codes one at a time. I have 255 files each with 255 sequential codes. Using this I’m working my way through 65,025 IR codes in a range I think contains most or all the target codes. I’ve made it through 12,750 codes so far and so far I have 19 working codes. Here is a sample code if anyone wants try give it a try. I may post an entire list when I’m done.

Probably Freevie.ir (133 Bytes)
Secret_Menu.ir (139 Bytes)

3 Likes
Coolest ways to use flipper zero day 1-30
What legal stuff can i do with a Flipper zero?
Roku 2nd generation IR code brute force - Help test unknown codes?
Epson IR files
Become thanos for the ir remote control realm
Brute forcing IR
Convert Sub GHz Key file to RAW file
#2

It definitely uses IR as an option. I have a television with Android/FireOS integrated and misplaced my remote more often than I care to admit :joy: universal remote on the flipper always was able to at least switch the tv on/off

1 Like
#3

I think I can now do everything the Bluetooth remote does in IR with the exception of the voice commands. I can open the voice command window with IR but it just says my remote is not paired. I have 4000 codes left before I analyze all the results and determine the next step.

#4

I would not call you an idiot,but I am missing some information to follow.

The Fire TV devices are split in

  • Fire TV (flat box)
  • Fire TV Stick (smaller boxes, chocolate bar form factor)
  • Fire TV Cube (Cubes)

As far as I know, only the Cubes does have an IR receiver.

I know about MicroUSB-Ethernet adapter to the Stick and Cube 2nd Gen. And you are saying it is possible to add IR to (nearly?) all Fire devices?
A quick google research can’t find anything about that. Could you provide some sources?

And if you are done, it would be interesting to get a full report, to repeat this analysis for the Xbox IR feature, too :wink:

1 Like
#5

I’m very close to collecting all the IR codes in the correct format for the Flipper. I’m at parity with the official remotes but there seem to be some unusual codes like one that can factory reset the Fire TV and one that I believe does a hard reboot. One extremely strange code attempts to activate the voice remote feature but it just says the remote needs to be paired first.

Someone called me an idiot elsewhere because “Fire TV are Bluetooth”. People can’t seem to wrap their heads around the fact a device can do both. There are actual TV sets such as “Amazon Fire TV 55” Omni Series 4K UHD smart TV". That is what I’m currently working with. I’m not surprised you couldn’t find references for adding IR to Fire TV devices with a quick search. A deep search gives few good results. One of the few places I could find a reference was from FLIRC. They specialize in IR dongles and IR remotes. They even made an adapter specifically for Fire TV sticks. It goes inline so you don’t need to buy a USB hub.

They also make this remote(ships 2023) that is IR only and claim it is compatible with Fire TV devices over CEC or by adding an infrared receiver.

Does Skip work with the smart devices that have no IR input?

Two workarounds exist for these devices. Most support HDMI-CEC, which means you can control them using your TV remote buttons on the Skip 1s. Many also support USB in, including the Fire TV Stick, Raspberry Pis, and any other HTPC. For those, we suggest pairing your Skip with a Flirc USB for ultimate control.

#6

When you brute force the codes please do post them ! It will be cool if you manage to find some “secret” codes not present on the official remotes.

#7

The official remote has a few “secret” functions you can access by holding certain button combos. I appear to be finding those but it’s still pretty cool because I can send those commands to multiple devices at once. I don’t think the Bluetooth remotes can do that.

2 Likes
#8

https://www.youtube.com/shorts/_hPMwXev2W8

#9

Factory reset (like in your video)? Just press back an right at the navigation wheel. Than the FireTV will perform a Factory reset, as well.

Why should the BT remote have less commands than IR? The buttons can be combined as well.

The only advantage (or disadvantage) is the lack of pairing. You need to pair a BT Remote to give commands. You can just push IR codes… On the other hand, we have only a few FireTV, that are able to read IR out of the box.

Even if IR should not go through windows (simplified: you can’t get tan behind a window, because the energy-rich IR is filtered), I was able to switch IR lights on/off from the outside through a closed window.
So you could go around with your code and factory reset a FireTV cube in another house, in theory.

#10

What I meant is I don’t think the Bluetooth remotes can control multiple TV’s at one time. Sorry if that wasn’t clear.

I believe any commands I find will have a corresponding Bluetooth command accept possibly for power. If you play with the Fire TV remote you will find that the command to power on and off is sent exclusively over IR.

IR could potentially control 10 devices at once with no problem. A Bluetooth remote must be paired first to do anything more then turn on a Fire TV. That could be useful to someone needing to control multiple devices like a technician. I’m still not sure if I want to share the factory reset code because I’m sure a prankster will use that on a wall of Fire TV at an electronics retailer. I will definitely share the rest of the codes. They can be very useful in cases like home automation. I’m using the codes in Home Assistant with the Broadlink integration.

#11

Service codes will most likely be IR exclusive and will not be implemented on BT.

#12

BT is for the Flipper out of scope. Else I would like try to disproof you :wink:
Because there is no IR Interface in all the Fire TV devices and the Firmware should be similar, I think the approach is different, in that special case.

Back to topic:
Why should it be a problem to publish the Factory reset code? There are not much data on the FireTV. Just start, give your credentials and you can start again. Maybe you’ll need to reinstall/setup Netflix/Disney+. But no harm, no damage.

1 Like
#13

Perhaps we wire a micro controller to the official remote and brute force commands from that? :rofl:
I believe I will release all the codes since I haven’t had anyone express a concern. I have an IR receiver on the way so I can test on other models of Fire devices.

#14

I can test on Fire TV Cube Gen2.
I have here some Fire TV Stick Gen 1 and Gen 2 as well as the Fire TV Stick 4K as well. But all without IR.

Maybe your analysis will help me, too get more commands for my AVR … When I’ll find time.

1 Like
HashCat IR
#15

I finally received the hardware and the codes I’ve found don’t appear to work with my Fire TV stick. I’m going to try some other codes and see if anything works.

These codes did not work either but are meant for the FireTV Stick 4K Max.

#16

Maybe I’ll buy a flirc for one of my Kodi. Therefore I’ve tried to understand.

So the Flirc dongle is a piece of Hardware, based on a ARM processor, either via USB or Mircro-USB. The second one with power passthrough.

Both variants can be individually programmed. But I can’t see if you just Programm the input profile (FireTV, Kodi, Windows, …) or if the programming also provides different input variants, not depending on output.

Could you bring some light into the configuration?

There seems to be a GitHub repo: Flirc · GitHub … But I can’t spot any database, even in the SDK repo.
The provided Arch package seems to provide just the binary to install, too. No source.

#17

I think I finally understand everything I wanted to know about the system. In the case of Fire Devices that have built in IR there are codes they accept similar to the Bluetooth commands. In the case of using a FLIRC hardware add on the FLIRC device emulates a keyboard. In theory you should be able to program an IR remote to send a command that simulates any command a keyboard can do. Now I just have to figure out the keyboard commands used by fire devices. ̶T̶h̶e̶n̶ ̶p̶e̶r̶h̶a̶p̶s̶ ̶I̶ ̶c̶a̶n̶ ̶c̶o̶n̶v̶e̶r̶t̶ ̶s̶o̶m̶e̶ ̶o̶f̶ ̶t̶h̶o̶s̶e̶ ̶t̶o̶ ̶I̶R̶.̶ (Should have said map IR commands.) This is interesting because I now know I can essentially do Bad USB over IR which could be fortuitous because I’ve started moving on to Bad USB on the Fire TV.
EDIT: You program the FLIRC on your computer with a program then move it to the intended device if that isn’t your computer.

#18

I have submitted a pull request and the .ir files will hopefully show up in the flipper IRDB soon. EDIT: My pull has been accepted and the codes are part of the database.

1 Like
#19

I thought this was project was done but I found a whole ton of new codes. These codes are NEC rather then NECext. Maybe I found them all? Probably not… Some keys are duplicated but there are also some new keys in here. Among the new keys appear to be a discrete power on, discrete power off, 0-9, closed caption, and audio language. I’ll update the files over the next few days.

4 Likes
#20

Hey jmr,

Could you share those IR codes? The only ones on Github are power and vol up/down.
I’ve been scouring the interwebs trying to find IR codes for the fire stick and I’m not having much luck haha.

Thanks!

1 Like