Computer

Onkyo web control hack

Last Updated or created 2022-04-05

Back in 2009 i’ve posted my web controller for Onkyo in a forum.

Several people build on that source and made android/iphones app using this as example.

It uses pfsockopen with raw packets in php.
Spend a lot of work reverse engineering the tcp headers to be send.
Another fun trick was re-using a trick i’ve used for my ipcam controller and dartabase. (Dart game application)

Below a PDF with first page of forum

Onkyo-TX-NR-1007-Webinterface-Programming-_-AVForumsDownload

I’ve made a alteration in my logitechmediaserver (squeezebox server) which embedded a onkyo volume control part in the gui.

Volume Onkyo in LMS

Part of code

<?php
// :colorscheme elflord
// Henri Aanstoot
// Onkyo Reciever Web Interface 2009
// Version 0.6b - 23 Oct 2009
// EDIT THIS
$receiveripnumber="your.onkyo.ip.here";
$receiverlistenport="60128";
// maximum to set volume (0-100) 
// !! some have 64 max????
$volumemax=60;
// (i had to enable this port by going onto the menu's on my Onkyo
// ---- NO EDITING BELOW THIS LINE

// trick browser into staying on same page
$ibrowser = strpos($_SERVER['HTTP_USER_AGENT'],"iPhone");
if ($ibrowser == false) {
header("HTTP/1.0 204 No Response");
}
// test write to file
//$fp=fopen("test.txt", "wb");
// write to Receiver 
$fp = pfsockopen($receiveripnumber, $receiverlistenport, $errno, $errstr, 30);
//get command from post form
$command=$_POST['cmd'];
//get volume if cmd is numeric
if(is_numeric($command)) 
 {
if ($command > $volumemax) { $command=$volumemax; }
echo $command;
  $vol=str_pad(dechex($command), 2, '0', STR_PAD_LEFT);
  $command="!1MVL$vol";
 }
// Calculate header and datapacket lengths
$length=strlen($command); 
$length=$length+1;
$total=$length+16;
$code=chr($length);
// total eiscp packet to send 
$line="ISCP\x00\x00\x00\x10\x00\x00\x00$code\x01\x00\x00\x00".$command."\x0D";
#fputs($fp,$line,$total);
// write
fwrite($fp, $line);
// rest status part
//    while (!feof($fp)) {
//        echo fgets($fp, 128);
//    } 

fclose($fp);

if ($ibrowser == true) {
print "<html>
<head>
<title>Sending Command...</title>`
<meta http-equiv=\"refresh\" content=\"0;url=index.php\">
</head>
<body></body>
</html>";
}

?>

List of command’s

header,Power
!1PWR00,Poweroff
!1PWR01,Poweron
header,Muting
!1AMT00,Audio muting off
!1AMT01,Audio muting on
!1AMTQSTN,Audio muting stat
header, Speaker A/B (Main/Front?)
!1SPA00,Speaker A Off
!1SPA01,Speaker A On
!1SPB00,Speaker B Off
!1SPB01,Speaker B On
header,Sound modus
!1LMD00,STEREO
!1LMD01,DIRECT 
!1LMD02,SURROUND
!1LMD03,FILM
!1LMD04,THX
!1LMD05,ACTION
!1LMD06,MUSICAL
!1LMD07,MONO MOVIE
!1LMD08,ORCHESTRA
!1LMD09,UNPLUGGED
!1LMD0A,STUDIO-MIX
!1LMD0B,TV LOGIC
!1LMD0C,ALL CH STEREO
!1LMD0D,THEATER-DIMENSIONAL 
!1LMD0E,ENHANCED 7/ENHANCE
!1LMD0F,MONO 
!1LMD11,PURE AUDIO 
!1LMD12,MULTIPLEX
!1LMD13,FULL MONO
!1LMD14,DOLBY VIRTUAL
!1LMD40,5.1ch Surround
!1LMD40,Straight Decode*1
!1LMD41,Dolby EX/DTS ES
!1LMD41,Dolby EX*2
!1LMD42,THX Cinema
!1LMD43,THX Surround EX
!1LMD50,U2/S2 Cinema/Cinema2
!1LMD51,MusicMode
!1LMD52,Games Mode
!1LMD80,PLII/PLIIx Movie
!1LMD81,PLII/PLIIx Music
!1LMD82,Neo:6 Cinema
!1LMD83,Neo:6 Music
!1LMD84,PLII/PLIIx THX Cinema
!1LMD85,Neo:6 THX Cinema
!1LMD86,PLII/PLIIx Game
!1LMD87,Neural Surr*3
!1LMD88,Neural THX
!1LMD89,PLII THX Games
!1LMD8A,Neo:6 THX Games
!1LMDUP,Listening Mode Wrap-Around Up
!1LMDDOWN,Listening Mode Wrap-Around Down
header,Input Selector
!1SLI00,VIDEO1    VCR/DVR
!1SLI01,VIDEO2    CBL/SAT
!1SLI02,VIDEO3    GAME/TV
!1SLI03,VIDEO4    AUX1(AUX)
!1SLI04,VIDEO5    AUX2
!1SLI05,VIDEO6
!1SLI06,VIDEO7
!1SLI10,DVD
!1SLI20,TAPE(1)
!1SLI21,TAPE2
!1SLI22,PHONO
!1SLI23,CD
!1SLI24,FM
!1SLI25,AM
!1SLI26,TUNER
!1SLI27,MUSIC SERVER 
!1SLI28,INTERNET RADIO
!1SLI29,USB
!1SLI30,MULTI CH
!1SLI31,XM*1
!1SLI32,SIRIUS*1
!1SLIUP,Selector Position Wrap-Around Up
!1SLIDOWN,Selector Position Wrap-Around Down