16-09-2021

Samsung Rs232 Commands

  • The information (commands) controlling theTT455-RT-238 to send out Samsung RS232 commands, consist of 8 pcs. 3-digit numbers.These commands can be created in the CommandList section of theTT455-RT-238's Configurator. 0001= command Pa7 = Repeat (fixed 001) Pa6 =Parameter 6 (000) Pa5 =Parameter 5 (Value) Pa4 =Parameter 4 (Cmd3).
  • RS232C Command List. LAN Control Protocol. Download (PDF) Download (PDF) Sample Sheet Download (PDF) LF50.

It happens, that I get my new 32″ Samsung TV – model LE32D550. Like most of new Samsung TV’s (if not everyone) it could be connected into the LAN. Of course, one of the first thing I do when the network cable was connected was port-scan.

55000 is used for remote control over network. There is application for iPhone and Android smartphones (unfortunately only these created by Samsung) to control TV through WiFi. I did some research, and now I understand the protocol quite well.

When connection on port 55000 is established, remote control must be authenticated. It sends datagram.

And the meaning of this bytes.

Samsung RS232 Codes (Ex-Link) - Just Add Power Support

I don’t know the meaning of the string above, my TV is accepting any string in here, but I suggest to use this particular one just for compatibility reason.

The ExLink port allows serial control of the Samsung TV. For example, turn on/off, changed channels and etc. The ExLink cable has a 3.5mm jack (like a audio headphone cable) on one side and on the other side is an RS-232 interface. EX LINK PRO DSX-RX RS-232. RS-232 TYPE 2 Guest Mode For example, if you wish to send RS-232 commands to TV 1, then you will only need to Telnet the RS-232 to the PRO DSX-RX connected to TV1 EXLINK CATx HDMI 01 PRO DSX –RX Receiver CATx 02 PRO DSX –TX Transmitter CATx RS-232 HDMI 01 Controller TV 1 TV 2 Source 1 HDMI Over IP-PRO DSX RS-232 Controls Samsung ExLink 3. RS-232 on Samsung TV's RS-232 is an advanced and specialized form of installation that allows the TV to be controlled through a cable connected directly to the TV. Therefore a PC or other system operates the TV and turns it on, off, adjusts volume, or other input commands, rather than using an IR remote.

Payload starts with 2 bytes: 0x64 and 0x00, then comes 3 strings encoded with base64 algorithm. Every string is preceded by 2-bytes field containing encoded string length. These three strings are as follow:

  • remote control device IP,
  • unique ID – value to distinguish controllers,
  • name – it will be displayed as controller name.

TV reply us giving following datagram:

It means:

String content is always iapp.samsung or iphone.livingroom.iapp.samsung. Meaning of these strings is unclear, I suggest to not compare it with any specific value during response parsing (maybe other devices using another values).

Payload is one of the following:

  • 0x64, 0x00, 0x01, 0x00 – access granted, you can now send key codes and it will be executed by TV,
  • 0x64, 0x00, 0x00, 0x00 – access denied – user rejected your network remote controller,
  • 0x0A, 0x00, 0x02, 0x00, 0x00, 0x00 – waiting for user to grant or deny access for your app,
  • 0x65, 0x00 – timeout or cancelled by user.
Access is granted only during current TCP connection, when your app or TV disconnect, you have to repeat the authentication process.

Now you can send simple datagrams containing key codes.

It means:

And the payload is:

TV response will be similar to authentication response, but with different payload data. I will not describe this data detailed because I wasn’t investigated it much.

Key codes list is published in SamyGO wiki: http://wiki.samygo.tv/index.php5/D-Series_Key_Codes

Useful information can be found also in SamyGO Android Remote sources.

Samsung Qm55r Rs232 Commands

Benoit Dumasin created easy to use C++ class (using QT library) able to control Samsung TV: https://github.com/Bntdumas/SamsungIPRemote (he also provided an example QT widget).

Here is Wireshark protocol dissector create by Konstantin Salikhov (Koka58).