Unknown format for UEI app on Vizio Tablet and LG G2

bellyshelly · Post by **bellyshelly** » Sun Oct 27, 2013 12:52 pm

Hi guys!

I've been stalking this forum for a while trying to find an answer to my problem, without any luck. I have a few codes in some strange format I haven't seen before, which I'm trying to figure out. The purpose here is to understand this format so that eventually I can convert codes from JP1 (and other formats) to this one.

Here are two codes for the generic Samsung TVs:
vol up, 55, 16, 0, 12, 16, 1, -97, -49, 54, -101, -73, 44, -26, -100, -92, 40, -64, -69, 57, -67, 115, -81, -4, 39, 87, 10, -38, -71, -104, -19, 18, -112, 121, -58, 100, 99, 81, -41, 125, 116, 63, 29, 49, -111, 5, 36, -53, -20, 70, -81, 96, -73, 88, 119, -91, 90,

vol down, 55, 16, 0, 13, 16, 1, 25, 7, -93, 22, -65, 84, -128, -69, 112, -48, -1, -50, -86, -98, -40, 32, -4, 39, 87, 10, -38, -71, -104, -19, 18, -112, 121, -58, 100, 99, 81, -41, 120, -121, -93, -91, -49, -97, 15, -9, -53, -20, 70, -81, 96, -73, 88, 119, -91, 90,

I'm willing to pay for help with this as much as it takes, as it's really important for me.

UPDATE #1:
it's a signal sent by the preinstalled app on the Vizio Tablet. That app, and the hardware on that tablet were built by UEI, and all the access they give to us, the developers, is to use their own database of codes, which often lacks support for devices. I want to be able to use my own codes, which is why i'm trying to convert them into that format to send it.

UPDATE #2:
I just found out that the same thing happens with the preloaded Quick Remote app on the LG G2. Unfortunately, just as with the Vizio, there's no way of extracting the codes, or even having a simple look at them. To get those codes I had to do quite a bit of "hacking".

Either way, I'm sorry for not mentioning this before, but I have tried converting it to hex, then putting it through IR Scope. I have also gotten quite familiar with a lot of ir codes formats, and it simply doesn't look like anything I've seen.

Thank you!

Post by **vickyg2003** » Sun Oct 27, 2013 3:55 pm

What is this format for? It doesn't appear to be timing data in any form I've seen before. We use negatives to express quiet time, but this is not following that convention.

bellyshelly · Post by **bellyshelly** » Mon Oct 28, 2013 8:00 am

it's a signal sent by the preinstalled app on the Vizio Tablet. That app, and the hardware on that tablet were built by UEI, and all the access they give to us, the developers, is to use their own database of codes, which often lacks support for devices. I want to be able to use my own codes, which is why i'm trying to convert them into that format to send it.

Post by **The Robman** » Mon Oct 28, 2013 10:04 am

All JP1 upgrades are designed to work with UEI protocol executors, so if you give us more information about the app that UEI gave you and whatever instructions they gave you for it, I bet we can get JP1 upgrades working with it too.

So, the more info you give, the better we can help.

binky123 · Post by **binky123** » Mon Oct 28, 2013 10:33 am

Try converting it to Hex format and see if one of our tools can parse it. It may be UEI's Learned format.

Barf · Post by **Barf** » Mon Oct 28, 2013 11:20 am

binky123 wrote:Try converting it to Hex format and see if one of our tools can parse it. It may be UEI's Learned format.

It looks like a sequence of signed bytes (every entry is between -128 and 127). Transforming these signed bytes to unsigned hex (x < 0 ? x + 256 : x) gives

37 10 00 0C 10 01 9F CF 36 9B B7 2C E6 9C A4 28 C0 BB 39 BD 73 AF FC 27 57 0A DA B9 98 ED 12 90 79 C6 64 63 51 D7 7D 74 3F 1D 31 91 05 24 CB EC 46 AF 60 B7 58 77 A5 5A

and

37 10 00 0D 10 01 19 07 A3 16 BF 54 80 BB 70 D0 FF CE AA 9E D8 20 FC 27 57 0A DA B9 98 ED 12 90 79 C6 64 63 51 D7 78 87 A3 A5 CF 9F 0F F7 CB EC 46 AF 60 B7 58 77 A5 5A

which to my knowledge is not valid UEI learned format (ExchangeIR sez: Invalid format for learned signal: bursts extend beyond data.)

bellyshelly · Post by **bellyshelly** » Mon Oct 28, 2013 11:38 am

I just found out that the same thing happens with the preloaded Quick Remote app on the LG G2. Unfortunately, just as with the Vizio, there's no way of extracting the codes, or even having a simple look at them. To get those codes I had to do quite a bit of "hacking".

Either way, I'm sorry for not mentioning this before, but I have tried converting it to hex, then putting it through IR Scope. I have also gotten quite familiar with a lot of ir codes formats, and it simply doesn't look like anything I've seen.

bellyshelly · Post by **bellyshelly** » Mon Oct 28, 2013 11:42 am

Thank you Barf! I've also tried the same thing, but doing the conversion by simply adding 127 (and even 128) to each value.

Post by **The Robman** » Mon Oct 28, 2013 3:03 pm

Samsung TVs generally use NECx2 7.7
vol+ 007
vol- 011

Here are those codes in various formats:

1) Pronto Hex
Vol Up
0000 006d 0000 0022 00ac 00ac 0015 0040 0015 0040 0015 0040 0015 0015 0015 0015 0015 0015 0015 0015 0015 0015 0015 0040 0015 0040 0015 0040 0015 0015 0015 0015 0015 0015 0015 0015 0015 0015 0015 0040 0015 0040 0015 0040 0015 0015 0015 0015 0015 0015 0015 0015 0015 0015 0015 0014 0015 0015 0015 0015 0015 0040 0015 0040 0015 0040 0015 0040 0015 0040 0015 0689

Vol Down
0000 006d 0000 0022 00ac 00ac 0015 0040 0015 0040 0015 0040 0015 0015 0015 0015 0015 0015 0015 0015 0015 0015 0015 0040 0015 0040 0015 0040 0015 0015 0015 0015 0015 0015 0015 0015 0015 0015 0015 0040 0015 0040 0015 0015 0015 0040 0015 0015 0015 0015 0015 0015 0015 0015 0015 0015 0015 0015 0015 0040 0015 0015 0015 0040 0015 0040 0015 0040 0015 0040 0015 0689

2) Binary
Vol+ 11100000 11100000 11100000 00011111
Vol- 11100000 11100000 11010000 00101111

3) UEI Learned Format
Vol+ 04 10 25 00 D2 04 08 D5 08 D5 01 14 03 49 01 14 01 13 01 14 55 EC A2 01 11 22 22 21 11 22 22 21 11 22 22 22 22 11 11 13
Vol- 05 10 25 00 D2 04 08 D5 08 D5 01 14 03 49 01 14 01 14 01 14 55 EC A2 01 11 22 22 21 11 22 22 21 12 12 22 22 21 21 11 13

binky123 · Post by **binky123** » Tue Oct 29, 2013 11:28 am

It's possible that the code is encrypted. Some versions of the SlingBox format was encrypted. Does the tablet have a UEI chip inside of it or is the IR database purely in software?

bellyshelly · Post by **bellyshelly** » Tue Oct 29, 2013 2:44 pm

As far as I can tell it has an UEI chip inside, and yes, it's very possible that it is encrypted. Biggest tell is that the same code recorded/learned twice results in codes with pieces that are very different.
Here they are (the Vol UP recorded from a Samsung TV):

64,65,66,67,0,55,16,0,25,16,1,-79,-62,-63,68,42,-35,24,-63,-72,-56,122,77,90,-12,-110,54,-4,39,87,10,-38,-71,-104,-19,18,-112,121,-58,100,99,81,-41,125,116,63,29,49,-111,5,36,-53,-20,70,-81,96,-73,88,119,-78,77,

64,65,66,67,0,55,16,0,26,16,1,-52,85,-97,92,125,76,-58,59,-123,47,85,-113,-71,-72,-87,123,-4,39,87,10,-38,-71,-104,-19,18,-112,121,-58,100,99,81,-41,125,116,63,29,49,-111,5,36,-53,-20,70,-81,96,-73,88,119,-73,72,

As you can see though, a huge part of the code is common though..

bellyshelly · Post by **bellyshelly** » Tue Oct 29, 2013 3:02 pm

One more update:
Changing ANY of the bytes renders the code useless. The 10% tolerance rule doesn't apply here, if you change any of the numbers by even just 1, then it stops working.

This makes me think there are two things that may be happening here:
1. this code might have some kind of error checking embedded (like the Sony codes which have the second part of the code reversed for CRC, if memory serves)
or
2. this isn't an actual code, but a reference to the code in the chip's/driver's database.

binky123 · Post by **binky123** » Wed Oct 30, 2013 11:05 am

The Learned data format isn't usually encrypted but the device upgrade setup code and protocol upgrade codes are encrypted for Slingbox/Axum/Gondar chips. Can you take a picture of the UEI chip and/or list out some of the markings around it. If you want to sniff the protocol line between tablet and UEI chip, it is 9600 baud or 19200 baud.

bellyshelly · Post by **bellyshelly** » Wed Oct 30, 2013 11:41 am

Unfortunately I'd have to open up the phone / tablet to see the chip, and I'd like to postpone that for a bit (warranty issues). I DO know it's a msm8974 chipset though in the G2.
Also, the bitrate is 19200 baud, or at least that's the frequency with which the preinstalled Quick Remote app writes/reads data.

binky123 · Post by **binky123** » Wed Oct 30, 2013 11:43 pm

You've kind of lost me. I tried looking for a picture of the Vizio Tablet VTAB1008. It doesn't look like there is a UEI chip inside. They may be controlling things through software. Check out the UEI Nevo app and the UEI QuickSet Services SDK at the Android AppStore. The SDK has IR code information to control entertainment devices from different manufacturers and operators. This SDK is required in order to use the Nevo App.

For learned data, you'll normally see slight variations recorded from the sampling of the IR signal.

You may be able to disassemble the apk files to glean more info about the formats you are seeing.