Since I’m still waiting for all the audio components I ordered for E.V.E’s voice recognition functionality, let’s try in the meantime to interface E.V.E with a first home device.
The very first one that comes to my mind is of course a television set. Let’s try !
Reverse-engineering an Orange Livebox Play set-top box
I rely on Orange quadruple-play offer for xDSL, phone, 4G and television services. Orange provides a set of two boxes:
- A Sagemcom xDSL2 router coupled to a wireless access point, an Ethernet hub and a DECT base
- An atom based set-top box (also built by Sagemcom) connected (via Ethernet or WiFi) to the router
These devices are completed by a remote control and iOS /Android applications.
Unfortunately, Orange doesn’t publish any document on its API, or any information at all on how to interface with its devices. Which is a real shame.
But since Orange applications for smartphone and tablets are able to drive these equipment over Wifi (and hopefully HTTP), there is probably a way to reverse-engineer the protocol used.
The first thing is to identify the IP address of the set-top box. One can either use the router web administration interface (via the local URL http://livebox) or use the smartphone / tablet application “Ma Livebox” (my LiveBox):
Here, the IP address of my set-top box is: 192.168.1.10.
Then, since a lot of consumer-electronic devices use the UPnP protocol, I fired up upnp-inspector, which gave this :
It seems one can actually drive an Orange set-top box via HTTP requests on the 8080 port. Indeed the URL showing in the “Details” window gave:
Let’s move on, launch Orange application “TVcommande” (which turns a smartphone into remote control), and sniff out with kismet the HTTP traffic.
Testing each functionalities of the “WiFi remote”, it appeared it is driving the set-top box via simple HTTP requests of the form:
http://192.168.1.10:8080/remoteControl/cmd?operation=01&key=XXX&mode=YY
Where YY stands for:
And XXX stands for:
Indeed, a simple HTTP request like this:
http://192.168.1.10:8080/remoteControl/cmd?operation=01&key=116&mode=0
returns this message:
and powers on the device. Repeating this request will power off the device.
It turned out also that this request:
http://192.168.1.10:8080/remoteControl/cmd?operation=10
returns information about the state of the device. When the device is powered on, it returns:
When the device is powered off, it returns:
Now, let’s explore the “En direct” (i.e “live”) fonctionnality of the remote.
It first fires this HTTP request:
http://lsm-rendezvous040413.orange.fr/API/?api_token=be906750a3cd20d6ddb47ec0b50e7a68&output=json&withChannels=1
which gives back a long JSON answer. The following is an excerpt of it:
This JSON structure give information on what is broadcasted at the time of the request:
diffusions":{"diffusion":[{"epgId":"641641976","startTime":"1443718800","duration":"3300",
"title":"Money Drop","imageUrl":"http:\/\/resize.img.ke.voila.fr\/MA\/649468183_150.jpg",
"category":"Divertissement","subCategory":"jeu","csa":"TP","channelId":"192"}, ...
and information on the available channels:
"channels":{"channel":[{"id":"103","name":"TF1","ip":null,"tvIndex":"1",
"imageUrl":"http:\/\/media.programme-tv.orange.fr\/Images\/Chaines\/192.gif","image":"tf1.png",
"epgId":"192","liveThumbnails":"0","blendedTV":"1","htag":"#tf1","kind":"G\u00e9n\u00e9raliste"} ...
In “live” mode, pressing a channel button tunes the set-top box to the selected channel. Sniffing the traffic, it showed that it uses this kind of HTTP request:
http://192.168.1.10:8080/remoteControl/cmd?operation=09&epg_id=ZZZZZZZZZZ&uui=1
Where ZZZZZZZZZZ is a 10-characters long string. The right part of the string is the “epgId” of the channel (which can be obtained from the “channels” information from the previous JSON response). The rest of the string is filled with “*” characters.
Here are a few of these strings:
Sketching E.V.E’s interface for Orange TV
We now have enough information to implement a TV interface for E.V.E.
Here is a quick sketch for this interface, which should be quite easy to implement from we collected from the reverse-engineering :
Next step is implementing this sketch and see how it behaves in real life. Advanced functionalities could be added later on, such based on the information from the JSON of “live broadcast” request (title, preview, duration, … of shows)