Waking up with smart TV Sony Bravia

I am enjoying my new smart TV from Sony for a for quite a bit of time, and truly speaking I do not regret I haven’t bought plain one which I would connect to one of my Raspberry Pis and have fun with much more funtionalities. Well, I don’t loose any functionalities here, because little device can be still plugged in. But having TV which can do more than simple one has it’s limits. For some time I was being woken up with Sleep as Android app which is really good, if you expect to be woken up between REM phases. But now, when I got bored of that, I wanted to wake up and see my TV running one of my YouTube recommendation. Turns out that I don’t expect much and only thing I need is device running whole the time in the background. Well, I have two Raspberries running 247, so I’m good.

One of the good things is, that even if my TV is turned off, it’s actually turned on, but using much less power in standby mode and is being connected to my home WiFi all that time. Also it supports WakeOnLan action by desing, so it’s not much we need to do, to just turn it on. We need to just to install wakeonlan package on our linux distribution and run it with TV’s IP and MAC addresses. On raspbian, as we’re using Raspberry Pi device, it will be as simple as typing

sudo apt-get install wakeonlan

And usage is even much simplier than that

wakeonlan -i "01:23:45:67:89:01"

Where the first argument is TV’s IP and the second one is MAC address. The later one can be easily retrieved from Wlan settings on the device. This is the simpliest way to launch TV, but journey doesn’t end here, as long as I still need to run the YouTube app.

Simple nmap scan of the TV reveals nginx server running on standard 80 port. Nothing unusual at all, besides that with couple minutes of googling brings me to SOAP endpoint, which is really unusual to see in product manufactured in 2016. Anyway, payload is really simple and looks like that

   <u:X_SendIRCC xmlns:u="urn:schemas-sonycom:service:IRCC:1">	   

Tag IRCCCode seems to hold some binary command, which corresponds to every button on the remote. One can easily find those commands in Google, but there comes an easier way. GitHub repository with simple bash scripts to send codes and receive whole list from the device. The only catch is that it’s using really simple authentication code, which should be set on TV and in this case is “0000”, but this can be changed by editing .sh file.

Now, with all the tools needed, the only thing we need is to establish proper order of sending remote codes to the TV. In my case, after sending wake signal, I need to wait 5 seconds for device to fully launch. Then HOME button needs to be pressed, and after that I need to navigate into YouTube application on my applications list.

The only obstacle here is, that I have no idea what will the cursor position be on the list. But I can force it to be in upper left corner, by sending proper amount of LEFT and UP buttons’ remote codes. After that, the drill is simple: four times RIGHT, once DOWN and hit CONFIRM. Then waiting 20 seconds for YT app to load and et voilà – it works!

    function sendCmd {
      ./send_command.sh $IP $1
      sleep 1
    wakeonlan -i $IP $MAC
    sleep 5
    sendCmd $HOME
    for i in {1..5}; do sendCmd $UP; done
    for i in {1..10}; do sendCmd $LEFT; done
    for i in {1..4}; do sendCmd $RIGHT; done
    sendCmd $DOWN
    sendCmd $CONFIRM
    sleep 20
    sendCmd $CONFIRM

The sleep command is necessary here, because otherwise send_command.sh script works asynchronously and may send ie. CONFIRM command, when YT application is not yet launched, which will spoil the play. Code can be also found on my GitHub repository.