If someone does have this remote please do read it with flipper and post the flipper file for it.
Thanks.
1 Like
This sounds like an interesting project in our area of interest. @LupusE @emptythevoid We should see what we can find.
@jmr , I snorted when I read that! lol Iāve somewhat recently become aware of the notion of service remotes. A friend of mine was telling me he obtained a service remote for his LG tv specifically to adjust some kind of really crap dynamic brightness processing (I hope to obtain a capture of that someday). @Spildit recently posted requests for several service remotes today, so Iām curious if itās for a personal use, or if itās for the sake of making the codes public. In any case, this is on my radar now.
I know with the LG one I mentioned, simply having the remote wasnāt enough. There was at least one special button that triggered a prompt on the TV, which then required a PIN to be entered before getting into the settings. I donāt know anything about how these requested remotes work or what specific things they solve, so it may be difficult to test things without having either a compatible TV or the remote in-hand.
First thing I did was to see if any of my TV were hisense. Sadly they werenāt. I wonder how these remotes work. Do they use single codes or is it multiple codes like a macro? There are many questions to be answered. Multiple codes could be difficult to figure out.
I suspect the pin will be the same from one TV to the next or it will be based on the serial number. Hopefully we could brute force a pin or find a leaked pin.
At least with the LG, it seems the PIN was universal on all models that accepted the remote.
1 Like
Oh wow!! Definitely bookmarking. Good find!
Hi there.
Iām collecting service remotes/keys/sequences,
The ones on the posted link i already have :
I have the service remote for LG, Samsung TV, Philips, Beko, Toshiba and some others that i did buy and converted to flipper ā¦
Iām just having trouble buying that Hisense one (they only ship to UK) and i canāt find it anywhere else for sale (like ebay).
There is the possibility that it might even be a non-existing remote ā¦(that specific hisense one) as i canāt find it anywhere elseā¦
1 Like
For Beko just use NECext address 00 00 00 00 plus the commands on that site ā¦
so for service in/out use NECext at address 00 00 00 00 commnd 1D 00 00 00 and so on ā¦
Another example, for ALL modern Samsung (led, lcd,plasma,etc) Protocol Samsung32, addresss 07 send command āinfoā - 1F and the factory - 3B and you will be at service menu. press actory again and you will be in refresh mode / burn in mode. press it again to exit that mode and close service menu. 3SPEED is command 3C and allows you to access more options on service menu. command E6 is used as alterntive power off/on for Samsung signs / publicity devices as alternative to normal power 02.
DO NOT USE SERVICE MODE IF YOU DONāT KNOW WHAT YOU ARE DOING !!!
Do not use / enter CALIBRATION menus as it requires for you to input a test pattern otherwise you will brick your TV set.
DONāT CHANGE ANYTHING IF YOU ARE NOT 100% SURE WHAT YOU ARE DOING.
Also ā¦ LG service remote is available here : https://github.com/logickworkshop/Flipper-IRDB/tree/480562c1ec598097699e6d551285c837ddc008c6/TVs/LG (you can use INSTART, INSTOP, easy adjust, etc ā¦)
1 Like
Since I read your service remote requests yesterday, I have this some thought. Why do we need an extra service remote?
On one hand, you can take an extra licensing fee to radio and TV electrican on an extra device.
On the other hand, it would be good to avoid to get into service with your butt, by sitting on the remote.
But in any case, as long as the service is not reached by UART/GPIO/USB/ā¦, the companies would not build two IR eyes into the devices. If I can emulate the standard IR, I should be able to emulate the service remote.
At this point the project from @jmr can be used. He knows the address of the FireTV and tried all possible commands. Now we need to scan all possible addresses and need to get lucky on a command.
I would start with common addresses, like 00 00 00 00, FF FF FF FF, 12 34 56 78, ā¦
Do you remember how #service# (#737823# - press the button on numpad with the character) gets you to the āhidden menuā on older cellphones?
But @Spildit already has most of this covered.
1 Like
First service menu are not allways used for service ā¦ sometimes it can be used to hack/deface TVs, etc ā¦ think about the LG and Samsung option to change VESA/JEIDA and mess the collor pallet or the mirror/flip screen option, etc ā¦ not to talk about gaining access to IP or change settings ā¦ it can be uses for something not service/repair related ā¦
BE AWARE THAT THIS WILL VOID WARANTY as accessing service menu will be logged on the TV.
Accessing service menu can be of use to check true time of use of the TV set as well if you are buying one used set or to check stuff like error logs to diagnose faults, etc ā¦
Brute forcing service menu entry codes will most likely not help unless on something like BEKO because you need either a specific combination/sequence on normal remote to access service or on other devices like Samsung where you have a specific IR command for service you need to use it in sequence.
If you try to brute force Samsung and you hit command 3B it will not do a thing because first you need to send info - 1F and only then the TV will accept the āfactoryā and if you send something else after the 1F then the factory command will not work ā¦ o you need correct sequency. Same is valid for Pioneer,ā
Sometimes you need to have the actual remote to see what sequences/codes they are sending. For example of that philips old service remote the service keys send 4 different commands in sequence for each function, etc ā¦ so not as simple as it looks from the start ā¦
There are a few valid uses outside someone that actually services TV for a living. The one I found most interesting was enabling the HDMI port. Reading Amazon reviews of service remotes I came across someone who bought a service remote so his father could use a Chromecast during a long hospital stay. That might also be useful in a hotel. It occurred to me the HDMI protocol allows transport of an internet connection. Could we also make use of that if we enabled the HDMI port? A āproperā setup would have TV on their own LAN but I wonder what else might share the LAN on a lazy network setup.
Another āvalidā reason aside from checking the real hours of use of a set would be for example enable audio transmission via Bluetooth on Samsung sets that have Bluetooth hardware but itās disabled at factor ā¦ Also to āreverseā āhacksā done by others using service menu ā¦ like for example when someone goes to a public display sign/publicity and itās samsung and somene does info+factory+factory and the device gets āstuckā in refresh/burn-in mode ā¦ etc ā¦
Other use - disable TPC on LG Oledā¦
I can confirm that this remote appears difficult to obtain.
Out of curiosity, can you post the LG remote file somewhere?
1 Like
It lives in IrDB, TVs - LG - LG Service Remote
2 Likes
Excellent. Last time I looked, I either missed it or it wasnāt there yet.
1 Like