LG TV hacking via serial connection or IR codes

[Brendan Robert] has been sending us forum thread links outlining the things he’s learned while hacking LG televisions. They were a bit hard to follow for the uninitiated, so we asked if he could give us an overview of what he’s been working on. Not only did he do that, but he made a little Hackaday shout-out seen above by adding the skull and cross-wrenches as one of the menu overlays.

He’s using a TV as his computer monitor, which he picked up at a discount because it was a display model. Without the original remote, and wanting to have features like power-saving mode which is standard on monitors but not on this TV, he decided to see what he could accomplish. A couple of things made this quite a bit easier. First, there’s an RS232 port built into the back which removes the need to investigate and solder your own onto the board. Secondly, since LG built on the Linux kernel for the set, you can download some of the firmware sources from their website.

What he came up with is a script that will find and communicate with the TV over the serial connection. The test script used during development polled every possible command, looking for valid return values. Once [Brendan] established which commands work and what they do, he was able to take command of the unit, writing scripts to adjust brightness based on the ambient light in the room as seen from the computer’s webcam. Make sure you check out the sub-pages to his post that detail the brightness adjustments, stand-by functionality, custom overlay graphics, and the extra commands he uncovered.

17 thoughts on “LG TV hacking via serial connection or IR codes

  1. Synergy is sweet indeed! I’ve had hit-or-miss luck with it in terms of error recovery (in the event of a flaky connection or reset router). For the most part, I try using ssh x-forwarding since both computers run linux. I’m considering winswitch, but am getting odd errors from it.

    I think it might be nice to have a custom PiP or maybe a pigin notifier using the OSD — so that I don’t miss anything if I’m watching TV or anything else that is equally unproductive. You can (easily) display a JPG and scale it to any size as an overlay very easily. The trouble is getting the image to /tmp on the TV without a memory stick.

  2. Side note: My apologies for a total lack of artistic talent. It might have looked better if I used the actual HaD logo instead of a pixelated one. I originally tried using a transparent PNG but couldn’t get the OSD debug menu to blit anything other than JPGs. But I wanted something with transparency so it didn’t look ‘shopped.

  3. This stuff has been known for a decade now. All integrators have been doing this with LG tv’s for a very long time. the CD that comes with the TV’s has all the codes documented.

    Now crack into the Firmware… That will impress me.

  4. Why reinvent the wheel? OpenLGTV and LGMOD are readily available. I’m not in a hurry to brick my TV in the quest to determine compatibility though. And, though you might think the codes are all documented, that is in fact not true at all. LG does not document how to set the tool options (useful for unlocking DivX playback) or all of the remote control button presses (MC commands). Nor do they document how to poke around the debug features to mess with the OSD. The hack here is gaining additional functionality WITHOUT modding (perhaps bricking) the TV.

  5. It would be so cool to be able to use the IR port on the front of the TV to throw code and force a custom menu overlay up. This would make a trip to the local appliance shop so much more entertaining “Gorilla Advertising” :)

  6. defyboy: Check out the MC codes subpage for a few undocumented surprises. :-) My next stop is to manipulate the OSD debug menu to do more that fly a jolly roger, I just need to work out a solid file transfer mechanism.

  7. I’ve added a new subpage for this: How to send binary files over using the debug shell. Thank the FSM that this TV has awk in the /bin directory already. Many thanks to Peter van Eerten for his base64 decode awk script, which I’ve tailored to this purpose. Next step: custom OSD notifications!

  8. As I look around the back of my 47″ LG… YES!!!

    A serial port… JOY!! I had *NO* idea that I could hack my TV so easily.. WooooHoooo!!

    Thank for the eye opener BLuRry ;)

  9. One of my first jobs as a techie was to go around to peoples places to flash the firmware on there LG tvs as there was a run that was shipped with buggy firmware. I had to change the Baud rate first before running the software that LG supplied. There were a bunch of passwords for them and options to do a forced flash if the standard way didn’t work. Even if you bricked the TV by putting the wrong firmware on it, doing a forced flash with the right one would usually fix it…..damn, I wish I had kept that program and the password codes

  10. Ok, a fun update: The page where I document how to draw on the OSD (on screen display) has been updated to include an example of using image overlays. I’ve shell-scripted the process of resizing an image, transferring it to the TV over the serial cable and displaying it.

  11. Nice work BLuRry !
    About the undocumented serial commands… How did you brute-force them?
    Assuming a letter-only four character command you get around 18000 combinations, assuming 0.25 sec/command gives 30 hours of probing for a rather limited space of potential commands..!
    Where you just persistent or am I missing something??

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s